CECPQ1 (combined elliptic Curve and Post-Quantum Cryptography Key Exchange) is a new key exhange developed by google, which combine X25519 with NewHope (elliptic Curve KE + Post-quantum KE).

Google has implemented CECPQ1 in boringSSL But there isn't a documentation or clarified explanation, how it works.

Looking at the code, I think, there are two key exchanges - X25519 and NewHope. Results of those exchanges are concatenated (here) Then this concatenation is fed into KDF and used as session key.

So even if NewHope is broken whole scheme is secure, because X25519 is secure. Attacker must break both NewHope and x25519 to break a scheme.

Can someone confirm that? Or give me more details about CECPQ1? Like which KDF, it uses? what are the inputs and their sizes? Perhaps if there are any good articles or pdf, that describe well CECPQ1.

  • Wikipedia has some more details although it does not provide source for this. But the basic idea of these algorithms which combine classical key exchange with PQ key exchange is to be safe even if one of the parts is broken. – Steffen Ullrich Oct 14 '17 at 20:08
  • Wikipedia gives just some basics about CECPQ1. I am looking for implementation details (like which KDF is used for concatenation of X25519 and newhope results..) – Omar Oct 14 '17 at 20:18

According to the code you've linked to X25519 gives the first 32 bytes and NewHope gives the next 32 byte of the pre-master secret. This is also what Wikipedia says about this topic.

Like which KDF, it uses?

The process of deriving the master secret from the pre-master secret is the same as for the other and more traditional key exchange algorithms and is clearly defined in the TLS 1.2 standard in section 8.1. Computing the Master Secret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.