And then both MLKEM.Decaps and KDF could share same masked Keccak implementation, reducing area needed for it.ps. On the same vein -- It would be absolutely fantastic if we could get rid of HKDF as it is the one thing in TLS 1.3 forcing masked SHA2 on my chip. As a symmetric cryptography design, HKDF is about as inelegant as possible, and currently one of the hardest things to mask & secure in hardware. Arguably better SHA3-based KDFs have existed for a long time, and I'd like to use my masked Keccak module for KDF. But that's perhaps for later.
+1
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
