Abstraction Layer for Hybrid KEMs

[FAlbertDev]

We plan to add various KEM combiners in the following weeks/months. A KEM combiner is a KEM (with a KEM interface) that internally consists of two (or more) KEMs and/or key exchange algorithms transformed into KEMs. They are used for combining PQC with a classical public key algorithm. For that, this PR defines an abstract interface, a common base for these combiners.

In general, each KEM combiner consists of multiple public/private keys stored internally that are used to encapsulate multiple shared secrets. These multiple shared secrets are combined (using some sort of KDF) into a single shared secret. For that, the abstraction stores multiple public/private keys and implements the common boilerplate, such as defining the overall strength by returning the strength of the strongest sub-algorithm, etc. Also, a convenient interface for Encryptors and Decryptors is implemented. The existing TLS KEM combiner has been refactored to use this hybrid KEM abstraction.

For the BSI Project 481, we currently plan to implement the following three additional KEM combiners:

• X-Wing (Draft): Combines X25519 with ML-KEM-768. Developed by Cloudflare.
• Ounsworth KEM-Combiner (Draft): Can combine any KEMs. Backed by BSI.
• CatKDF and/or CasKDF: Combines ECDH with any PQC KEM. It is defined as a KEX, but a translation to KEM is given. ETSI standard, recommended in BSI TR-02102-1 Section B.1.2..

[coveralls]

coverage: 91.353% (+0.009%) from 91.344%
when pulling 2cbadce on Rohde-Schwarz:kem-combiner-abstraction
into 13edb92 on randombit:master.

[FAlbertDev]

Rebased to master

[FAlbertDev]

Rebased to master.

[randombit]

Some overly verbose iterator usage that I object to on aesthetic grounds :) but otherwise lgtm

[randombit]

Here again a for loop seems simpler and shorter

for(const auto* k: m_sks) {
   BOTAN_ARG_CHECK(k != nullptr, "List of secret keys contains a nullptr");
   BOTAN_ARG_CHECK(k->supports_operation(PublicKeyOperation::KeyEncapsulation), "Some provided secret key ...");
}

[reneme]

What was a holding us back from ranges again? 😅 Was it Xcode/NDK again?

[FAlbertDev]

Thanks for the review. I agree that loops are easier to read here. It's quite sad that these C++ iterators are so bulky :(

I addressed your review comments.

[FAlbertDev]

I also made the KEX to KEM adapter header public. This is very useful for applications using non-predefined KEX algorithms with KEM combiners. Let me know what you think.

[FAlbertDev]

Rebased to master

[FAlbertDev]

@randombit Sorry for the late update. I applied your review suggestions, rebased to master, and cleaned-up the history (to make it less bulky in the depending PRs).