PQC: update KEM key combiner (draft-08)

Author: larabr

src/crypto/public_key/post_quantum/kem/kem.js

@@ -15,33 +15,32 @@ export async function generate(algo) {
 export async function encrypt(algo, eccPublicKey, mlkemPublicKey, sessioneKeyData) {
   const { eccKeyShare, eccCipherText } = await eccKem.encaps(algo, eccPublicKey);
   const { mlkemKeyShare, mlkemCipherText } = await mlKem.encaps(algo, mlkemPublicKey);
-  const kek = await multiKeyCombine(algo, eccKeyShare, eccCipherText, eccPublicKey, mlkemKeyShare, mlkemCipherText, mlkemPublicKey);
+  const kek = await multiKeyCombine(algo, mlkemKeyShare, eccKeyShare, eccCipherText, eccPublicKey);
   const wrappedKey = await aesKW.wrap(enums.symmetric.aes256, kek, sessioneKeyData); // C
   return { eccCipherText, mlkemCipherText, wrappedKey };
 }
 
 export async function decrypt(algo, eccCipherText, mlkemCipherText, eccSecretKey, eccPublicKey, mlkemSecretKey, mlkemPublicKey, encryptedSessionKeyData) {
   const eccKeyShare = await eccKem.decaps(algo, eccCipherText, eccSecretKey, eccPublicKey);
   const mlkemKeyShare = await mlKem.decaps(algo, mlkemCipherText, mlkemSecretKey);
-  const kek = await multiKeyCombine(algo, eccKeyShare, eccCipherText, eccPublicKey, mlkemKeyShare, mlkemCipherText, mlkemPublicKey);
+  const kek = await multiKeyCombine(algo, mlkemKeyShare, eccKeyShare, eccCipherText, eccPublicKey);
   const sessionKey = await aesKW.unwrap(enums.symmetric.aes256, kek, encryptedSessionKeyData);
   return sessionKey;
 }
 
-async function multiKeyCombine(algo, ecdhKeyShare, ecdhCipherText, ecdhPublicKey, mlkemKeyShare, mlkemCipherText, mlkemPublicKey) {
-  // LAMPS-aligned and NIST compatible combiner, proposed in: https://mailarchive.ietf.org/arch/msg/openpgp/NMTCy707LICtxIhP3Xt1U5C8MF0/
-  // 2a. KDF(mlkemSS || tradSS || tradCT || tradPK || Domain)
-  //     where Domain is "Domain" for LAMPS, and "mlkemCT || mlkemPK || algId || const" for OpenPGP
+/**
+ * KEM key combiner
+ */
+async function multiKeyCombine(algo, mlkemKeyShare, ecdhKeyShare, ecdhCipherText, ecdhPublicKey) {
+  const domSep = util.encodeUTF8('OpenPGPCompositeKDFv1');
   const encData = util.concatUint8Array([
     mlkemKeyShare,
     ecdhKeyShare,
     ecdhCipherText,
     ecdhPublicKey,
-    // domSep
-    mlkemCipherText,
-    mlkemPublicKey,
     new Uint8Array([algo]),
-    util.encodeUTF8('OpenPGPCompositeKDFv1')
+    domSep,
+    new Uint8Array([domSep.length])
   ]);
 
   const kek = await computeDigest(enums.hash.sha3_256, encData);