[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 20 26-07-08)

On 7/10/2026 11:54 AM, Nico Williams wrote:

...

> So in a way hashing `m` adds no value because if the attacker knows
> you'll be hashing `m`: since we're talking about an attacker that can
> convince you to use their RNG they can just make you use one where
> hashing `m` achieves nothing.
>
> But it might be more difficult to switch out the RNG at this late a
> stage.  On that basis one might recommend some application level
> whitening of RNG outputs: on the off chance that the attacker was in
> fact counting on the use of raw RNG outputs for `m` [and nonces].

Yes, just hashing the RNG achieves little. What you want is whitening 
the RNG. You could do that by including a nonce in the hash or by 
encrypting the RNG output with a local key. Or you could do all kind of 
elaborate solutions, maybe some kind of sponge construct. Or you could 
use something like AES-CTR-DRBG, which satisfies the requirements 
for NIST SP 800-90A Compliance, and which I understand is included in 
Boring SSL.

-- Christian Huitema

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]