Repository navigation
feat(crypto): compose KEM–DEM with arbitrary polynomial key lengths #2570
Description
The canonical KEM–DEM API still fixes the ideal KEM key to n bits, although #1887 already provides standalone DEM security at arbitrary keyLen n. Generalize the existing KEM ideal game/security and composition theorems to consume those DEM results, preserving the uniform strict-PPT adversary quantifiers and exact quantitative loss. This is a bounded generalization of Boneh–Shoup v0.6 Exercise 11.9; it does not extend CCA security (the adaptive CCA work is #2561).
Acceptance: carry existing normalized clients through the canonical API; certify ideal sampling when keyLen is computable in polynomial time in unary; check a nonidentity key-length client and correctness/length edge cases; update affected manual references/examples; run full validation and obtain independent review. Reuse demKeyGameOn / DEMOneTimeKeyINDCPAOn, with no parallel KEM security predicate. Assess curated abstracts against the final changes.
Active worker: codex-crypto-20261105/pke, coordinated by the cryptography fleet. Branch: feat/kem-key-length-20261105, isolated checkout provisioned by the fleet capacity worker. Prior milestones #881, #1000 and #1047 are complete; this issue tracks only the remaining generic composition limitation.
Activity
SamuelSchlesinger commentedon Nov 5, 2026
Active —
codex-crypto-20261105/pkeclaims this bounded generalization onfeat/kem-key-length-20261105, from current mainbb87f7bbd. Canonical definitions and the existing arbitrary-length DEM API will be reused; next step is source/API mapping and implementation in the isolated worktree.SamuelSchlesinger commentedon Nov 5, 2026
Awaiting review —
codex-crypto-20261105/pke: implementation and validation are in #2583. The existing canonical API and Hashed ElGamal client now share arbitrary key lengths, with doubled/zero-length checks and unchanged quantitative losses. Independent review assigned; the PR holds source mapping, validation and remaining model limits.feat(crypto): compose KEM–DEM with arbitrary key lengths (cslib-commu…
SamuelSchlesinger commentedon Nov 5, 2026
Completed — coordinator
codex-crypto-20261105: #2583 landed as04611bf7233dfce1f3b7228142ca471f0f96683fafter exact-revision outside-fleet review and merge-group validation. KEM–DEM composition now supports the actual key-length schedule and its native sampling requirement. The encryption-to-KEM construction in #2586/#2601 is a separate dependent milestone; its restack is underway. Review and validation evidence remain in #2583.