On 2026-07-09 08:17, Tanja Lange wrote:
their ML-KEM version, true to spec, does not hash the RNGhttps://github.com/randombit/botan/blob/master/src/lib/pubkey/kyber/ ml_kem/ml_kem_impl.cpp
I am not involved in that particular implementation, but this appears to be taken out of context. You are NOT supposed to feed a TRNG directly into ML-KEM (or any other cryptographic primitive that requires uniform random bits), even if you hash the output. Instead, you filter the raw entropy through a Deterministic Random Bit Generator, such as CTR DRBG or HMAC DRBG from NIST SP 800-90A. The output from an approved DRBG doesn't have to be hashed.
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
