[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 20 26-07-08)

On 2026-07-09 10:10, Tanja Lange wrote:
> The question by Benjamin Kaduk was if there are cases where the server hellow
> would not leak the state of the PRNG (adding P for clarity^*) and Botan
> implements that protection. There are other libraries that have seperate PRNGs
> for public and private values.

Yes, but just hashing the output from a DRBG is not the approved way to 
do it. Instead you are supposed to spawn a secondary DRBG with a seed 
generated from a primary DRBG. Just hashing wouldn't do much good, if 
you are really concerned that the DRBG output might reveal anything 
about the internal state.

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]