I like these ideas, I wonder what speeds/niceties we could get in our TLS impl by taking advantage of the SHA3 absorb/squeeze pattern
On Thu, Jul 2, 2026 at 12:22 PM Kris Kwiatkowski <[email protected]> wrote: > > ps. On the same vein -- It would be absolutely fantastic if we could get > rid of HKDF as it is the one thing in TLS 1.3 forcing masked SHA2 on my > chip. As a symmetric cryptography design, HKDF is about as inelegant as > possible, and currently one of the hardest things to mask & secure in > hardware. Arguably better SHA3-based KDFs have existed for a long time, and > I'd like to use my masked Keccak module for KDF. But that's perhaps for > later. > > And then both MLKEM.Decaps and KDF could share same masked Keccak > implementation, reducing area needed for it. > +1 > _______________________________________________ > TLS mailing list -- [email protected] > To unsubscribe send an email to [email protected] >
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
