[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 20 26-07-08)

On 2026-07-09 08:17, Tanja Lange wrote:
> their ML-KEM version, true to spec, does not hash the RNG
> 	https://github.com/randombit/botan/blob/master/src/lib/pubkey/kyber/ 
> ml_kem/ml_kem_impl.cpp

I am not involved in that particular implementation, but this appears to 
be taken out of context. You are NOT supposed to feed a TRNG directly 
into ML-KEM (or any other cryptographic primitive that requires uniform 
random bits), even if you hash the output. Instead, you filter the raw 
entropy through a Deterministic Random Bit Generator, such as CTR DRBG 
or HMAC DRBG from NIST SP 800-90A. The output from an approved DRBG 
doesn't have to be hashed.

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]