Policy and regulation
Quantum is Coming…Quantum computing, QML and post-quantum cryptography. Policy and regulation
Quantum is Coming…

Powered by QiC Solutions
NewsAI

Policy and regulation · Quantum-Safe

IETF approves Composite ML-KEM, hybrid post-quantum encryption for X.509 certificates

The IESG approves Composite ML-KEM, which joins ML-KEM with RSA or elliptic curves in a single X.509 key. It is not an RFC yet: it is being edited.

Redacción · · 3 min

Illustration of a gold padlock in front of a blue globe, crossed by circuit lines
Image: Tumisu / Pixabay

Key points

  • On 12 October the IESG approved Composite ML-KEM, which combines ML-KEM with RSA, ECDH, X25519 or X448 in a single X.509 key.
  • It is not an RFC yet: it is in the RFC Editor queue, in reference checking and formatting after version 23 of 14 October.
  • It defines twelve combinations, none mandatory; it recommends ML-KEM-768 with X25519 or with P-256 and, for level 5, ML-KEM-1024 with P-384.

The body that approves the standards of the Internet Engineering Task Force (IETF), the IESG, has approved Composite ML-KEM, the specification that combines the post-quantum mechanism ML-KEM with a classical algorithm in a single key for X.509 certificates. According to the document’s history, the approval dates from 12 October, and on the same day it entered the queue of the RFC Editor, which prepares it for publication as a standard with Proposed Standard status.

It is not yet an RFC and has no number. The RFC Editor put it on hold that same day, 12 October, pending input from the authors; on 14 October they uploaded a new version, the 23rd, and the document went back to reference checking and formatting. Its authors are Mike Ounsworth and John Gray (Entrust), Massimiliano Pala (OpenCA Labs), Jan Klaußner (Bundesdruckerei) and Scott Fluhrer (Cisco), and it comes from the LAMPS working group.

What it defines

The document registers twelve combinations of ML-KEM, the key encapsulation mechanism that NIST standardised in FIPS 203, with RSA-OAEP, with elliptic-curve Diffie-Hellman (ECDH over P-256, P-384, P-521 and the Brainpool curves) or with X25519 and X448. Each combination has a single public key and a single ciphertext, so protocols that already use X.509, such as PKCS#10 requests, CMP or certificates themselves, treat it like any other algorithm, without knowing there are two inside. An attacker would have to break both components to obtain the shared secret.

The text explains what the combination is for: protecting against a break or a serious flaw in ML-KEM, which is young, and adding post-quantum cryptography to a solution that has already been audited and certified without invalidating its certification. That is why there are so many combinations: the idea is that each organisation starts from the classical algorithm it has already deployed. None is mandatory, but for those with no regulatory requirements or legacy systems it recommends two: ML-KEM-768 with X25519 (the combination known as X-Wing) and ML-KEM-768 with P-256. For environments that only accept NIST security level 5, ML-KEM-1024 with P-384.

  • Only for encryption or key agreement. A certificate with a composite key can only carry the keyEncipherment usage; the document forbids using one component for signing and the other for encryption.
  • FIPS certification. According to the authors, under the rules of NIST publication SP 800-227 it is enough for one of the two components to be certified for the combination to be certifiable.
  • No compatibility with what is already installed. Only updated systems understand the new identifiers; systems already deployed will not be able to use these keys.

Note · what this document does not cover

This is the encryption part. Hybrid signatures and use in messages encrypted with CMS are dealt with in other specifications, and the wording may still change in editorial details until the RFC is published.

What changes for decision-makers

Until now, anyone who wanted hybrid keys in their public key infrastructure (PKI) depended on drafts that could change. With the approval, the identifiers and the format are all but settled, and manufacturers of cryptographic modules, certificate authorities and libraries have a stable reference to implement. It is also what some European agencies are asking for: the German guidance we have covered recommends combining classical and post-quantum algorithms. For anyone planning a migration, the practical question is which combination to choose and whether their suppliers support it: the specification itself warns that supporting many would fragment the ecosystem.

Keep reading

Share