ML-KEM and Hybrid Cipher Suites for Messaging Layer Security

Introduction The potential availability of a cryptographically-relevant quantum computer has caused concern that well-funded adversaries could overturn long-held assumptions about the security assurances of classical Key Exchange Mechanisms (KEMs) and classical cryptographic signatures, which are fundamental to modern security protocols, including the MLS protocol . Of particular concern are "harvest now, decrypt later" attacks, by which an attacker could collect encrypted traffic now, before a quantum computer exists, and later use a quantum computer to break the confidentiality protections on the collected traffic. In response to these concerns, the cryptographic community has defined "post-quantum" algorithms, which are designed to be resilient to attacks by quantum computers. Symmetric algorithms can be made post-quantum secure simply by using longer keys and hashes. For asymmetric operations such as KEMs and signatures, entirely new algorithms are needed. In this document, we define ciphersuites that use the post-quantum secure Module-Lattice-Based KEM (ML-KEM) together with appropriate symmetric algorithms, and either traditional or Module-Lattice-Based Digital Signature Algorithm (ML-DSA) post-quantum signature algorithms. The traditional signature cipher suites address the risk of "harvest now, decrypt later" attacks, while not taking on the additional cost of post-quantum signatures. The cipher suites with post-quantum signatures use only post-quantum KEMs. Following the pattern of base MLS, we define several variations, to allow for users that prefer to only use NIST-approved cryptography, users that prefer a higher security level, and users that prefer a PQ/traditional hybrid KEM over pure ML-KEM:

ML-KEM-768 + X25519 (128-bit security, Non-NIST, PQ/T hybrid)
ML-KEM-768 + P-256 (128-bit security, NIST, PQ/T hybrid)
ML-KEM-1024 + P-384 (192-bit security, NIST, PQ/T hybrid)
ML-KEM-768 (128-bit security, NIST, pure PQ KEM)
ML-KEM-1024 (192-bit security, NIST, pure PQ KEM)
ML-KEM-768 (192-bit security, NIST, pure PQ)
ML-KEM-1024 (256-bit security, NIST, pure PQ)

Some parts of the community wish to support the 128-bit security level with the same the Authenticated Encryption with Authenticated Data (AEAD) algorithm and hash function as used in the traditional cipher suites registered in (AES128 GCM and HMAC with SHA-256 ), while other parts of the community would like to follow recent recommendations to transition immediately to AES256 GCM and HMAC with SHA-384 . For all of the cipher suites defined in this document, we use SHAKE256 (Section 3.2 of ) as the Key Derivation Function (KDF). For the cipher suites at the 192-bit or 256-security levels, we use AES256 GCM as the AEAD algorithm. For the cipher suites at the 192-bit security level we use HMAC with SHA-384, while for the 256-bit security level we use HMAC with SHA-512 . For the PQ/T hybrid KEMs and the pure ML-KEM HPKE integration, we use the KEMs defined in . The signature schemes for ML-DSA-65 and ML-DSA-87 are defined in .

IANA Considerations

MLS Cipher Suites This document requests that IANA add the following entries to the "MLS Cipher Suites" registry, replacing "XXXX" with the RFC number assigned to this document:

Value	Name	Rec	Reference
TBD1	MLS_128_MLKEM768X25519_AES128GCM_SHA256_Ed25519	Y	RFCXXXX
TBD2	MLS_128_MLKEM768X25519_AES256GCM_SHA384_Ed25519	Y	RFCXXXX
TBD3	MLS_128_MLKEM768P256_AES128GCM_SHA256_P256	Y	RFCXXXX
TBD4	MLS_128_MLKEM768P256_AES256GCM_SHA384_P256	Y	RFCXXXX
TBD5	MLS_192_MLKEM1024P384_AES256GCM_SHA384_P384	Y	RFCXXXX
TBD6	MLS_128_MLKEM768_AES256GCM_SHA384_P256	Y	RFCXXXX
TBD7	MLS_192_MLKEM1024_AES256GCM_SHA384_P384	Y	RFCXXXX
TBD8	MLS_192_MLKEM768_AES256GCM_SHA384_MLDSA65	Y	RFCXXXX
TBD9	MLS_256_MLKEM1024_AES256GCM_SHA512_MLDSA87	Y	RFCXXXX

The mapping of cipher suites to HPKE primitives , HMAC hash functions, and TLS signature schemes is as follows:

Value	KEM	KDF	AEAD	Hash	Signature
0xTBD1	0x647a	0x0011	0x0001	SHA256	ed25519
0xTBD2	0x647a	0x0011	0x0002	SHA384	ed25519
0xTBD3	0x0050	0x0011	0x0001	SHA256	ecdsa_secp256r1_sha256
0xTBD4	0x0050	0x0011	0x0002	SHA384	ecdsa_secp256r1_sha256
0xTBD5	0x0051	0x0011	0x0002	SHA384	ecdsa_secp384r1_sha384
0xTBD6	0x0041	0x0011	0x0002	SHA384	ecdsa_secp256r1_sha256
0xTBD7	0x0042	0x0011	0x0002	SHA384	ecdsa_secp384r1_sha384
0xTBD8	0x0041	0x0011	0x0002	SHA384	mldsa65
0xTBD9	0x0042	0x0011	0x0002	SHA512	mldsa87

The hash used for the MLS transcript hash is the one referenced in the cipher suite name. "SHA246", "SHA384" and "SHA512" refer to the SHA-256, SHA-384, and SHA-512 functions defined in .

Security Considerations The first seven ciphersuites defined in this document combine a post-quantum (or PQ/T hybrid) KEM with a traditional signature algorithm. As such, they are designed to provide confidentiality against quantum and classical attacks, but provide authenticity against classical attacks only. Thus, these cipher suites do not provide full post-quantum security, only post-quantum confidentiality. The last two cipher suites also use post-quantum signature algorithms. For security considerations related to the KEMs used in this document, please see the documents that define those KEMs and . For security considerations related to the post-quantum signature algorithms used in this document, please see and .