PSEC-KEM Specification
version 2.01
NTT Information Sharing Platform Laboratories,
NTT Corporation
September 3, 2007

History
version 2.01

2007/9/3

version 2.0
version 1.1
version 1.0

2007/6/14
2002/5/14
2001/9/26

Compatible specification with ISO/IEC 18033-2.
SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 are added.
Compatible specification with ISO/IEC 18033-2.
Compatible specification with CRYPTREC recommended cipher.
Submitted specification to CRYPTREC.

2

Contents
1 Introduction

4

2 Notation

4

3 Data types and conversions
3.1 Integer-to-BitString Conversion(I2BSP) . . . . . . . . . . . . . . . . . . . . . . .
3.2 BitString-to-Integer Conversion(BS2IP) . . . . . . . . . . . . . . . . . . . . . . .
3.3 BitString-to-OctetString Conversion(BS2OSP) . . . . . . . . . . . . . . . . . . .
3.4 OctetString-to-BitString Conversion(OS2BSP) . . . . . . . . . . . . . . . . . . .
3.5 Integer-to-OctetString Conversion(I2OSP) . . . . . . . . . . . . . . . . . . . . . .
3.6 OctetString-to-Integer Conversion(OS2IP) . . . . . . . . . . . . . . . . . . . . . .
3.7 Field Element-to-Integer Conversion(FE2IP) . . . . . . . . . . . . . . . . . . . .
3.8 Integer-to-Field Element Conversion(I2FEP) . . . . . . . . . . . . . . . . . . . .
3.9 FieldElement-to-OctetString Conversion(FE2OSP) . . . . . . . . . . . . . . . . .
3.10 OctetString-to-FieldElement Conversion(OS2FEP) . . . . . . . . . . . . . . . . .
3.11 EllipticCurvePoint-to-OctetString Conversion (ECP2OSP) . . . . . . . . . . . . .
3.12 OctetString-to-EllipticCurvePoint Conversion(OS2ECPP) . . . . . . . . . . . . .
3.13 Partial EllipticCurvePoint-to-OctetString Conversion (PECP2OSP) . . . . . . .

4
4
6
6
7
7
7
8
8
9
9
10
11
12

4 Key types
12
4.1 PSEC-KEM system parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.2 PSEC-KEM private key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.3 PSEC-KEM public key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
5 Key encapsulation mechanisms
5.1 KGP-PSEC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2 ES-PSEC-KEM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.1 Encryption operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2.2 Decryption operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13
14
14
14
15

6 Auxiliary techniques
6.1 Allowable Hash functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.2 Allowable Key derivation functions . . . . . . . . . . . . . . . . . . . . . . . . . .
6.2.1 MGF1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15
15
15
16

A Security requirements of parameters

17

B Recommended values of parameters

17

C ASN.1 Syntax

17

3

1

Introduction

This document provides a specification for implementing PSEC-KEM, which is a key encapsulation mechanism(KEM). We can utilize the mechanism for realizing key agreement schemes.
This document covers the following issues:• cryptographic primitives: KGP-PSEC• key encapsulation mechanisms: ES-PSEC-KEM
This specification is compatible with the PSEC-KEM in ISO/IEC 18033-2 [1]. For the usageof KEM in the hybrid encryption applications, see [1].

2Notationbit
bit string
octet
octet stringRZN
a := bIFqm
O
hB0 , B1 , . . . , Bi−1 i
hM0 , M1 , . . . , Mi−1 i
k

⊕
dye
byc
GCD(a, b)a|ba mod ma−1 mod m

3

one of the two symbols 0 or 1.
an ordered sequence of bits.
a bit strings of length 8.
an ordered sequence of octets.
the set of real numbers.
the set of integers.
the set of positive integers.
assign b to a.
a finite field with q m elements, where q is a prime.
a point at infinity on an elliptic curvea bit string of length i, for example, h0, 1, 0, 0i.
an octet string of length i, for example, h170, 255, 0i.
a concatenation operator for two bit strings or for two octet strings,
for example, h0, 1, 0, 0i k h1, 1, 0i = h0, 1, 0, 0, 1, 1, 0i for bit strings,
h170, 255i k h0, 20i = h170, 255, 0, 20i for octet strings. The operator
is often omitted.
the bit-wise exclusive-or operation
for y ∈ R, the least integer greater than or equal to y.
for y ∈ R, the greatest integer less than or equal to y.
for a ∈ N , b ∈ N , the greatest common divisor of a and b.
relation between integers a and b that holds if and only if a divides b,i.e., there exists an integer c such that b = ac.
for a ∈ Z, m ∈ N , the least nonnegative integer b which satisfiesm|(a − b).
for a ∈ Z, m ∈ N , the least nonnegative integer b which satisfies
ab mod m = 1.

Data types and conversions

The schemes specified in this document involve operations using several different data types.
Figure 1 illustrates which conversions are needed and where they are described.

3.1

Integer-to-BitString Conversion(I2BSP)

Integers should be converted to bit strings as described in this section. Informally, the idea isto represent the integer in binary. Formally, the conversion routine, I2BSP(x, l), is specified as
4

'

$

Point on an
Elliptic Curve-OS2ECPP(M )P = (x, y) or O&ÂECP2OSP(P )¿Octet String MÁ%À

Mi is an octet.

x, y : Field Element

Â

Octet String
M = M0 M1 · · · Mn−1

À

6

I2

O
SP
O
(x
S2
,n
IP
)
(M
)


>

 Á

a) 

7
(

SP )2O  M
FE  EP(  2F OS




=


/
'
$
»
FE2IP(a) - Nonnegative¿¼ I2FEP(x)Integer x

&

%

x,
P(

l)

)
(B
IP

2
BS

BS
I2

S
oS
SS
SS
SS
SS
SS
SS
w
SS
Â

OS2BSP(M )Field Element a½

BS2OSP(B)¾?

Bit String
B = B0 B1 · · · Bl−1ÁBi ∈ {0, 1}
Figure 1: Conversion between data types
follows:
Input:
Output:Errors:Steps:

x a nonnegative integerlthe bit length of the output, a nonnegative integer
B a bit string of length l
INVALID

1. If l = 0, output an empty bit string and stop.
2. If x ≥ 2l , assert INVALID and stop.
3. Determine the x’s base-2 representation, xi ∈ {0, 1} such thatx = xl−1 2l−1 + xl−2 2l−2 + · · · + x1 2 + x0 .
4. For 0 ≤ i ≤ l − 1, set Bi := xl−1−i , and let
B := B0 B1 · · · Bl−1 .
5¿À5. Output B.

3.2

BitString-to-Integer Conversion(BS2IP)

Bit strings should be converted to integers as described in this section. Informally, the idea issimply to view the bit string as the base-2 representation of the integer. Formally, the conversion
routine, BS2IP(B), is specified as follows:
Input:
Output:Steps:

Bx

a bit string of length la nonnegative integer

Convert B = B0 B1 · · · Bl−1 to an integer x as follows:
1. If l = 0, output 0 and stop.
2. View each Bi as an integer in {0, 1}, set xi := Bi for 0 ≤ i ≤ l − 1, and let
x :=

l−1
X

2(l−1−i) xi .

i=0

3. Output x.

3.3

BitString-to-OctetString Conversion(BS2OSP)

Bit strings should be converted to octet strings as described in this section. Informally, the idea
is to pad the bit string with 0’s on the left to make its length a multiple of 8, then chop theresult up into octets. Formally, the conversion routine, BS2OSP(B), is specified as follows:
Input:

Ba bit string of length l

Output:M

an octet string of length n =

» ¼

l
8

Steps:

Convert the bit string B = B0 B1 · · · B`−1 to an octet string M = M0 M1 · · · Mn−1 as follows:
1. If ` = 0, output an empty octet string and stop.
2. For j ∈ {0, . . . , 8n − 1}, let:
(
ej =
B

3. For i ∈ {0, . . . , n − 1}, set:Bj−(8n−`)0

if j ≥ 8n − `,if j < 8n − `.

e8i Be8i+1 · · · B
e8i+7
Mi := B

4. Output M .

6

3.4

OctetString-to-BitString Conversion(OS2BSP)

Octet strings should be converted to bit strings as described in this section. Informally, the idea
is simply to view the octet string as a bit string. Formally, the conversion routine, OS2BSP(M ),is specified as follows:
Input:
Output:Steps:

MB

an octet string of length na bit string of length l = 8n

Convert the octet string M = M0 M1 · · · Mn−1 to a bit string B = B0 B1 · · · B`−1 as follows:
1. If ` = 0, output an empty bit string and stop.
2. For i ∈ {0, . . . , n − 1}, j ∈ {0, . . . , 7}, determine B8i+j ∈ {0, 1} that satisfy
Mi = B8i B8i+1 · · · B8i+7
3. Output B.

3.5

Integer-to-OctetString Conversion(I2OSP)

Integers should be converted to octet strings as described in this section. Informally, the idea
is to represent the integer in binary and then convert the resulting bit string to an octet string.
Formally, the conversion routine, I2OSP(x, n), is specified as follows:
Input:
Output:Errors:Steps:xa nonnegative integernthe octet length of output.
M an octet string of length n
INVALID

BS2OSP(I2BSP(x, 8n))3.6

OctetString-to-Integer Conversion(OS2IP)

Octet strings should be converted to integers as described in this section. Informally, the idea
is simply to view the octet string as the base-256 representation of the integer. Formally, theconversion routine, OS2IP(M ), is specified as follows:
Input:
Output:Steps:

Mx

an octet string of length na nonnegative integer

Convert M = M0 M1 · · · Mn−1 to an integer, x, as follows:
BS2IP(OS2BSP(M ))

7

3.7

Field Element-to-Integer Conversion(FE2IP)

Field elements should be converted to integers as described in this section. A field element
should be represented as a polynomial with integer coefficients, which can be represented as asequence of the coefficients. Informally, the idea is simply to view the sequence of the coefficientsas the radix-q representation of the integer, where q is the characteristic of the field. Formally,
the conversion routine, FE2IP(a), is specified as follows:
System parameters:

IFqm

Input:
Output:Steps:

ax

a finite field with q m elements where q is a prime, and m > 0
is an integer
a field element in IFqm
an integer in {0, . . . , q m − 1}

Convert field element a to integer x as follows:
if m = 1:
Field element a must be represented as an integer in {0, . . . , q − 1}.
1. Let x := a.
2. Output x.
if m > 1:
Field element a must be represented as a polynomial of at most (m−1)-th degreewith coefficients in {0, . . . , q − 1}. Let β be the variable of the polynomial.
1. Determine the coefficients ai ∈ {0, . . . , q − 1} for i ∈ {0, . . . , m − 1} thatsatisfya=m−1
Xai β i .

i=0

2. Compute
x :=

m−1
X

ai q i .

i=03: Output x.

3.8

Integer-to-Field Element Conversion(I2FEP)

Integers should be converted to field elements as described in this section. A field element
should be represented as a polynomial with integer coefficients, and it can be represented as asequence of the coefficients. Informally, the idea is to represent the integer with radix-q positional
number system where q is the characteristic of the field, and then convert the each digit to theeach coefficient of the polynomial. Formally, the conversion routine, I2FEP(x), is specified asfollows:
System parameters:

IFqm

Input:
Output:Steps:xaa finite field with q m elements where q is a prime, and m > 0
is an integer
an integer in {0, . . . , q m − 1}a field element in IFqm

Convert integer x to field element a as follows:8if m = 1:
A field element of IFqm must be represented as an integer in {0, . . . , q − 1}.
1. Let a := x.
2. Output a.
if m > 1:
A field element of IFqm must be represented as a polynomial of at most (m−1)-thdegree with coefficients in {0, . . . , q−1}. Let β be the variable of the polynomial.
1. Expand x into it’s radix q representation xi ∈ {0, . . . , q − 1} for i ∈{0, . . . , m − 1} that satisfies
x=

m−1
X

xi q i .

i=0

2. Compute
a :=

m−1
X

xi β i .

i=03: Output a.

3.9

FieldElement-to-OctetString Conversion(FE2OSP)The conversion routine, FE2OSP(a), is specified as follows:
System parameters:

IFqmn

Input:
Output:Steps:aM

a finite field with q m elements where q is a prime, and m > 0
is an integer»¼
m log2 q
an integer equivalent to8
a field elementan octet string

1. Let
M := I2OSP(FE2IP(a), n).
2. Output M .

3.10

OctetString-to-FieldElement Conversion(OS2FEP)The conversion routine, OS2FEP(M ), is specified as follows:
Input:
Output:Steps:

Maan octet stringa field element

1. Leta := I2FEP(OS2IP(M )).
2. Output a.

9

3.11

EllipticCurvePoint-to-OctetString Conversion (ECP2OSP)Elliptic curve points should be converted to octet strings as described in this section. Informallythe idea is that, if point compression is being used, the compressed y-coordinate is placed in
the leftmost octet of the octet string along with an indication that point compression is on, andthe x-coordinate is placed in the remainder of the octet string; otherwise if point compression
is off, the leftmost octet indicates that point compression is off, and remainder of the octet
string contains the x-coordinate followed by the y-coordinate. Formally, the conversion routine,
ECP2OSPE (P, R), is specified as follows:
System parameters:
Input:
Output:Steps:E an elliptic curve parameterPa point on an elliptic curve over IFqm
R Compressed, Uncompressed, or Hybrid
M an octet string of length n
if P = O,

 n=1
¼
»


m log2 q
n=+1
if P 6= O and R is Compressed,
where
8
»
¼



 n = 2 m log2 q + 1 if P 6= O and R is Uncompressed or Hybrid.

8

Convert P to an octet string M = M0 M1 · · · Mn−1 as follows:
1. If P = O, output M := I2OSP(0, 1) .
2. If P = (x, y) 6= O and R = Compressed, proceed as follows:
2.1. Set octet string X := FE2OSP(x).
2.2. Derive from y a single bit ỹ as follows (this allows the y-coordinate to be represented
compactly using a single bit):
2.2.1. If q is an odd number, set ỹ := 0 if y = 0, set ỹ := yi mod 2 if y 6= 0, wherey = ym−1 β m−1 + · · · + y1 β + y0 , and i is the smallest integer such that yi 6= 0.
2.2.2. If q = 2, set ỹ := 0 if x = 0, otherwise compute z = zm−1 β m−1 + · · · + z1 β + z0
such that z = yx−1 and set ỹ := z0 .
2.3. If ỹ = 0, assign the value I2OSP(2, 1) to the single octet L. If ỹ = 1, assign the value
I2OSP(3, 1) to the single octet L.
2.4. Output M := L k X.
3. If P = (x, y) 6= O and R = Uncompressed, proceed as follows:
3.1. Set octet string X := FE2OSP(x).
3.2. Set octet string Y := FE2OSP(y).
3.3. Output M := I2OSP(4, 1) k X k Y .
4. If P = (x, y) 6= O and R = Hybrid, proceed as follows:
4.1. Set octet string X := FE2OSP(x).
4.2. Set octet string Y := FE2OSP(y).
4.3. Derive from y a single bit ỹ as follows (this allows the y-coordinate to be represented
compactly using a single bit):10

4.3.1. If q is an odd number, set ỹ := 0 if y = 0, set ỹ := yi mod 2 if y 6= 0, wherey = ym−1 β m−1 + · · · + y1 β + y0 , and i is the smallest integer such that yi 6= 0.
4.3.2. If q = 2, set ỹ := 0 if x = 0, otherwise compute z = zm−1 β m−1 + · · · + z1 β + z0
such that z = yx−1 and set ỹ := z0 .
4.4. If ỹ = 0, assign the value I2OSP(6, 1) to the single octet L. If ỹ = 1, assign the value
I2OSP(7, 1) to the single octet L.
4.5. Output M := L k X k Y .

3.12

OctetString-to-EllipticCurvePoint Conversion(OS2ECPP)

Octet strings should be converted to elliptic curve points as described in this section. Informally,
the idea is that, if the octet string represents a compressed point, the compressed y-coordinate
is recovered from the leftmost octet, the x-coordinate is recovered from the remainder of theoctet string, and then the point compression process is reversed; otherwise the leftmost octetof the octet string is removed, the x-coordinate is recovered from the left half of the remaining
octet string, and the y-coordinate is recovered from the right half of the remaining octet string.
Formally, the conversion routine, OS2ECPP(M ), is specified as follows:
System parameters:
Input:EM

an elliptic curve parameteran octet string that is either
the single octet,¼»

m log2 q+ 1, oran octet string of length n =» 8¼
m log2 q
an octet string of length n = 2+1
8P
an elliptic curve point
INVALID

Output:Errors:Steps:

Convert M to a point P on E as follows:
1. If M = I2OSP(0, 1), output P := O.
»¼

m log2 q
2. If M has length+ 1 octets, proceed as follows:
8»

2.1. Parse M = L k X as a single octet L followed bym log2 q8¼octets X.

2.2. Set x := OS2FEP(X).
2.3. If L = I2OSP(2, 1), set ỹ := 0, and if L = I2OSP(3, 1), set ỹ := 1. Otherwise assert
INVALID and stop.
2.4. Derive from x and ỹ elliptic curve point P := (x, y), where:
2.4.1. If q is an odd number, compute the field element w := x3 + ax + b, andcompute a square root γ of w in IFqm . Assert INVALID and stop if there are nosquare roots in IFqm , set y = 0 if γ = 0, otherwise set y := γ if γi ≡ ỹ mod 2,
and set y := −γ if γi 6≡ ỹ mod 2, where γ = γm−1 β m−1 + · · · + γ1 β + γ0 , and iis the smallest integer such that γi 6= 0.
m−1
2.4.2. If q = 2 and x = 0, set y := b2
in IFqm .

11

2.4.3. If q = 2 and x 6= 0, compute the field element γ := x + a + bx−2 in IFqm , andfind an element z = zm−1 β m−1 + · · · + z1 β + z0 such that z 2 + z = γ in IFqm .
Assert INVALID and stop if no such z exists, otherwise set y := xz in IFqm if
z0 = ỹ, and set y := x(z + 1) in IFqm if z0 6= ỹ.
2.5. Output P := (x, y).
»¼

m log2 q
3. If M has length 2+ 1 octets, proceed as follows:
8»

3.1. Parse M = L k X k Y as a single octet L followed by»¼¼

m log2 q
octets X followed by
8

m log2 q
octets Y .
83.2. Check that L = I2OSP(4, 1) or I2OSP(6, 1) or I2OSP(7, 1). If L 6= I2OSP(4, 1) or
I2OSP(6, 1) or I2OSP(7, 1), assert INVALID and stop.
3.3. Set x := OS2FEP(X).
3.4. Set y := OS2FEP(Y ).

3.5. If P := (x, y) does not satisfy the defining equation of elliptic curve E, then assert
INVALID and stop.
3.6. Output P := (x, y).

3.13

Partial EllipticCurvePoint-to-OctetString Conversion (PECP2OSP)

System parameters:
Input:E
P

Output:M

Steps:

an elliptic curve parameterma point on an elliptic curve over¼
» IFq
m log2 q.
an octet string of length n =8Convert P to an octet string M = M0 M1 · · · Mn−1 as follows:
1. If P = O, output M := I2OSP(0, n) .
2. If P = (x, y) 6= O, output FE2OSP(x) .

4

Key types

In this section, two types of keys are defined: PSEC-KEM system parameters, PSEC-KEM
private key and PSEC-KEM public key.

4.1

PSEC-KEM system parameters

A PSEC-KEM system parameters are the following value:• E,

an elliptic curve parameter• KDF , the choice from key derivation functions• hLen, a nonnegative integer• keyLen,a nonnegative integer
12An elliptic curve parameter E is the 9-tuple (q, m, f (β), a, b, P, p, pLen, qmLen), where thecomponents have the following meanings:• q, a prime number• m,a positive integer• f (β), a monic irreducible polynomial of degree m over IFq• a, an element in IFqm
• b, an element in IFqm
• P,

a point on an elliptic curve– x, an element in IFqm
– y,an element in IFqm

y 2 = x3 + ax + b (q > 3)
y 2 + xy = x3 + ax2 + b (q = 2)
• p,a prime, the order of P

• pLen, the value of dlog256 pe• qmLen, the value of dlog256 q m e

4.2

PSEC-KEM private key

A PSEC-KEM private key is the following value:• s, a nonnegative integer

4.3

PSEC-KEM public key

A PSEC-KEM public key is the following value:• W,

a point on E

Valid PSEC-KEM public key W = sP holds, where s is an element in PSEC-KEM private
key as decribed in Section 4.2 and W is a PSEC-KEM public key as decribed in Section 4.3.
Note: KDF shall be one of the key derivation functions in Section 6.2.

5Key encapsulation mechanisms

A key encapsulation mechanism works just like a public-key encryption scheme, except thatthe encryption algorithm takes no input other than the recipient’s public key. Instead, theencryption algorithm generates a pair (k, c0 ), where k is an octet string of some specified length,
and c0 is an encryption of k, that is, the decryption algorithm applied to c0 yields k.
One can always use a public-key encryption scheme for this purpose, generating a random
octet string, and then encrypting it under the recipient’s public key. However, as we shall see,
one can construct a key encapsulation scheme in other, more efficient, ways as well.
PSEC-KEM consists of two operations.
13• The encryption operation ES-PSEC-KEM-Encrypt(P K, R) that takes as input public
key P K and outputs ciphertext/key pair (c0 , k).
• The decryption operation ES-PSEC-KEM-Decrypt(P K, s, c0 ) that takes as input public key P K, private key s and ciphertext c0 , and outputs key k.

5.1

KGP-PSEC

KGP-PSEC() is defined as follows:
Input:
Output:W
s

KGP-PSEC takes no input
PSEC-KEM public key
PSEC-KEM private key, a nonnegative integer, 0 ≤ s < p

Steps:
1. Generate a random integer s ∈ {0, · · · , p − 1}.
2. Let W := sP .
3. Output W and s.

5.2
5.2.1

ES-PSEC-KEM
Encryption operation

ES-PSEC-KEM-Encrypt(P K, R) is defined as follows:
Input:
Output:Assumptions:
Steps:W PSEC-KEM public key
R Compressed, Uncompressed, or Hybridk
an octet stringc0 an octet string
public key P K is valid.

1. Generate a random octet string r ∈ {0, · · · , 255}hLen .
2. Let H := KDF (I2OSP(0, 4) k r, pLen + 16 + keyLen).
3. Parse H = t k k, where the octet length of t is pLen + 16; the octet length of k is keyLen.
4. Let α := OS2IP(t) mod p.
5. Let C1 := αP .
6. Let Q := αW .
7. Let c2 := r ⊕ KDF (I2OSP(1, 4) k ECP2OSP(C1 , R) k PECP2OSP(Q), hLen).
8. Let c0 := ECP2OSP(C1 , R) k c2 .
9. Output (k, c0 ).

14

5.2.2

Decryption operation

ES-PSEC-KEM-Decrypt(P K, s, c0 ) is defined as follows:
Input:

Output:Errors:Assumptions:
Steps:P K PSEC-KEM public keys
PSEC-KEM private key, a nonnegative integer, 0 ≤ s < pc0
an octet stringk
an octet string
INVALID
public key P K and private key s are valid.

1. If the octet length of c0 is less than or equal to hLen, assert INVALID and stop.
2. Parse c0 = g k c2 , where g and c2 are octet strings such that the octet length of c2 is hLen.
3. Let C1 := OS2ECPP(g).
If OS2ECPP asserts INVALID, assert INVALID and stop.
4. Let Q := sC1 .
5. Let r := c2 ⊕ KDF (I2OSP(1, 4) k g k PECP2OSP(Q), hLen).
6. Let h := KDF (I2OSP(0, 4) k r, pLen + 16 + keyLen).
7. Parse h = t k k, where the octet length of t is pLen + 16; the octet length of k is keyLen.
8. Let α := OS2IP(t) mod p.
then assert INVALID and stop.
9. Check C1 := αP .
If it holds, output k. Otherwise, assert INVALID and stop.

6

Auxiliary techniquesThis section gives several examples of the techniques that support the functions described inthis document.

6.1

Allowable Hash functions

The allowable hash functions are SHA-1, SHA224, SHA256, SHA384 and SHA512 describedin ISO/IEC 10118-3 [2].

6.2

Allowable Key derivation functions

MGF1 [3] is recommended. MGF1 is the same as KDF1 in [1].

15

6.2.1

MGF1

MGF1 is a mask generation function based on a hash function.
MGF1(M, n) is defined as follows:
System parameters:

HashhashLen

Input:Mnmask
INVALID

Output:Errors:Steps:

hash function
length in octets of the hash function output, a positive
integerseed from which mask is generated, an octet string
the octet length of the output, a positive integermask, an octet string of length n

1. Let n0 be the octetlength of M . If n0 + 4 is greater than the input limitation for the hashfunction, assert INVALID and stop.
»

2. Let cThreshold :=¼

n.
hashLen

3. If cThreshold > 232 , assert INVALID and stop.
4. Let M 0 be the empty octet string.
5. Let counter := 0.
(a) Convert the integer counter to an octet string C of length 4 octets:
C := I2OSP(counter , 4).
(b) Concatenate M and C, and apply the hash function to the result to produce a hashvalue H of length hashLen octets:
H := Hash(M k C).
(c) Concatenate M 0 and H to the octet string M 0 :M 0 := M 0 k H.
(d) Let counter := counter + 1. If counter < cThreshold , go back to step 5a.
6. Let mask be the leftmost n octets of the octet string M 0 :0mask := M00 M10 · · · Mn−1.

7. Output mask .

References[1] ISO/IEC 18033 – Information technology – Security techniques – Encryption algorithms –Part 2: Asymmetric ciphers, ISO, 2005a.
[2] ISO/IEC 10118 – Information technology – Security techniques – Hash functions – Part 3:
Dedicated Hash functions, ISO, 2004.
[3] RSA Laboratories, “PKCS #1 v2.1: RSA Encryption Standard,” draft 2, January 5, 2001.

16

Appendix
A

Security requirements of parameters

Security requirements of PSEC-KEM parameters are the following:
pLen ≥ 20
hLen ≥ 16

B

Recommended values of parameters

Recommended values of PSEC-KEM parameters are the following:
pLen ≥ 28
KDF(224bit)= MGF1(SHA-256, hashLen = 32)

hLen = 32
R = Compressed
keyLen = 32C

(256bit)

ASN.1 Syntax--###################################################################
ntt-ds OBJECT IDENTIFIER ::= {itu-t(0) networkoperator(3) ntt(4401) ds(5) }id-PSEC-KEM-v2
OBJECT IDENTIFIER ::={ ntt-ds 3 1 8 }DEFINITIONS EXPLICIT TAGS ::= BEGIN-- EXPORTS All; -IMPORTS
BlockAlgorithms
FROM EncryptionAlgorithms-3 { iso(1) standard(0)encryption-algorithms(18033) part(3)asn1-module(0) algorithm-object-identifiers(0) }HashFunctionAlgs, id-sha1, NullParms
FROM DedicatedHashFunctions { iso(1) standard(0)hash-functions(10118) part(3) asn1-module(1)dedicated-hash-functions(0) };--###################################################################-- oid definitions
OID ::= OBJECT IDENTIFIER -- alias-- Synonyms -is18033-2 OID ::= { iso(1) standard(0) is18033(18033) part2(2)}id-ac OID ::= { is18033-2 asymmetric-cipher(1) }id-kem OID ::= { is18033-2 key-encapsulation-mechanism(2) }id-dem OID ::= { is18033-2 data-encapsulation-mechanism(3) }id-sc OID ::= { is18033-2 symmetric-cipher(4) }id-kdf OID ::= { is18033-2 key-derivation-function(5) }17

id-rem OID ::= { is18033-2 rsa-encoding-method(6) }id-hem OID ::= { is18033-2 himer-encoding-method(7) }id-ft OID ::= { is18033-2 field-type(8) }-- Key encapsulation mechanisms -id-kem-psec OID ::= { id-kem psec(2) }-- Data encapsulation mechanisms -id-dem-dem1 OID ::= { id-dem dem1(1) }id-dem-dem2 OID ::= { id-dem dem2(2) }id-dem-dem3 OID ::= { id-dem dem3(3) }-- Symmetric ciphers -id-sc-sc1 OID ::= { id-sc sc1(1) }id-sc-sc2 OID ::= { id-sc sc2(2) }-- Key derivation functions -id-kdf-kdf1 OID ::= { id-kdf kdf1(1) }id-kdf-kdf2 OID ::= { id-kdf kdf2(2) }-- new field types oids-- id-ft-prime-field OID ::= { id-ft prime-field(1) }-- used only to define new basis typeid-ft-characteristic-two OID ::= { id-ft characteristic-two(2) }id-ft-odd-characteristic OID ::= { id-ft odd-characteristic(3) }id-ft-characteristic-two-basis OID ::={ id-ft-characteristic-two basisType(1) }charTwoPolynomialBasis OID ::={ id-ft-characteristic-two-basis
charTwoPolynomialBasis(1) }id-ft-odd-characteristic-basis OID ::= { id-ft-odd-characteristic
basisType(1)}oddCharPolynomialBasis OID ::= {id-ft-odd-characteristic-basis
oddCharPolynomialBasis(1)}-- MGF1 in PKCS #1 is equivalent to KDF1 here-- id-mgf1 should be used instead of id-kdf-kdf1 for compatibility-- with existing implementations
alg-mgf1-sha1 RsaesKeyDerivationFunction ::= {algorithm id-mgf1,
parameters HashFunction : alg-sha1}
alg-sha1 HashFunction ::= {algorithm id-sha1,
parameters NullParms : NULL}
pkcs-1 OID ::= {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1}
id-mgf1 OBJECT IDENTIFIER ::= {pkcs-1 8}
id-itu-sha1 OBJECT IDENTIFIER ::= { iso(1)identified-organization(3) oiw(14)secsig(3) algorithms(2) 26 }id-itu-sha224 OBJECT IDENTIFIER ::= {{ joint-iso-itu-t(2)country(16) us(840) organization(1) gov(101)csor(3) nistalgorithm(4) hashalgs(2) 4 }id-itu-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)18country(16) us(840) organization(1) gov(101)csor(3) nistalgorithm(4) hashalgs(2) 1 }id-itu-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)country(16) us(840) organization(1) gov(101)csor(3) nistalgorithm(4) hashalgs(2) 2 }id-itu-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)country(16) us(840) organization(1) gov(101)csor(3) nistalgorithm(4) hashalgs(2) 3 }id-camellia128-cbc OBJECT IDENTIFIER ::=iso(1) member-body(2) 392 200011 61 security(1)algorithm(1) symmetric-encryption-algorithm(1) camellia128-cbc(2)id-aes OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) country(16) us(840)organization(1) gov(101) csor(3)_ nistAlgorithms(4) 1 }id-aes128-CBC OBJECT IDENTIFIER ::= { id-aes 2 }--###################################################################-- KEM information objects
KeyEncapsulationMechanism ::= AlgorithmIdentifier {{ KEMAlgorithms }}KEMAlgorithms ALGORITHM ::= {{ OID id-kem-psec PARMS PsecKemParameters } |{ OID id-PSEC-KEM-v2 PARMS PsecKemParameters },... -- Expect additional algorithms -}--###################################################################-- PSEC-KEM-- an element of the group given in PsecKemParameters (may be 0)
PsecKemPrivateKey ::= INTEGER
PsecKemPublicKey ::= FieldElement
PsecKemParameters ::= SEQUENCE {group Group OPTIONAL,
keyDerivationFunction KeyDerivationFunction,
seedLength INTEGER (1..MAX),
keyLength KeyLength -- Length by byte}-- DEM specifications
DataEncapsulationMechanism ::= AlgorithmIdentifier {{DEMAlgorithms}}
DEMAlgorithms ALGORITHM ::= {{ OID id-dem-dem1 PARMS Dem1Parameters } |{ OID id-dem-dem2 PARMS Dem2Parameters } |{ OID id-dem-dem3 PARMS Dem3Parameters },... -- Expect additional algorithms -}Dem1Parameters ::= SEQUENCE{
symmetricCipher SymmetricCipher,mac MacAlgorithm}
Dem2Parameters ::= SEQUENCE{
symmetricCipher SymmetricCipher,19

mac MacAlgorithm,
labelLength INTEGER (0..MAX)}
Dem3Parameters ::= SEQUENCE{
mac MacAlgorithm,
msgLength INTEGER (0..MAX)}--###################################################################-- finite field, group, and elliptic curve representations
Group ::= CHOICE {groupOid OBJECT IDENTIFIER,
groupHashId OCTET STRING, -- defined in RFC2528
groupParameters GroupParameters}
GroupParameters ::= CHOICE {explicitFiniteFieldSubgroup[0] ExplicitFiniteFieldSubgroupParameters,
ellipticCurveSubgroup[1] EllipticCurveSubgroupParameters}
ExplicitFiniteFieldSubgroupParameters ::= SEQUENCE {fieldID FieldID {{FieldTypes}},
generator FieldElement,
subgroupOrder INTEGER,
subgroupIndex INTEGER}FIELD-ID ::= TYPE-IDENTIFIER
FieldID { FIELD-ID:IOSet } ::= SEQUENCE {fieldType FIELD-ID.&id({IOSet}),parameters FIELD-ID.&Type({IOSet}{@fieldType}) OPTIONAL}
FieldTypes FIELD-ID ::= {{ Prime-p IDENTIFIED BY prime-field } |{ Characteristic-two IDENTIFIED BY characteristic-two-field }|{ Odd-characteristic IDENTIFIED BY id-ft-odd-characteristic },... -- expect additional field types}-- prime fieds
Prime-p ::= INTEGER-- characteristic two fields
CHARACTERISTIC-TWO ::= TYPE-IDENTIFIER-- when basis is gnBasis then the basis shall be an optimal-- normal basis of Type T where T is determined as follows:-- if an ONB of Type 2 exists for the given value of m then-- T shall be 2, otherwise if an ONB of Type 1 exists for the-- given value of m then T shall be 1, otherwise T shall be-- the least value for which an ONB of Type T exists for the-- given value of m-- when basis is gnBasis then m shall not be divisible by 8
20

-- note: the above rule is from ANSI X9.62-- note: for the given m and T the ONB is unique
Characteristic-two ::= SEQUENCE {m INTEGER,-- extension degreebasis CHARACTERISTIC-TWO.&id({BasisTypes}),parameters CHARACTERISTIC-TWO.&Type({BasisTypes}{@basis})}
BasisTypes CHARACTERISTIC-TWO ::= {{ NULL IDENTIFIED BY gnBasis } |{ Trinomial IDENTIFIED BY tpBasis } |{ Pentanomial IDENTIFIED BY ppBasis } |{ CharTwoPolynomial IDENTIFIED BY charTwoPolynomialBasis },... -- expect additional basis types}
Trinomial ::= INTEGER
Pentanomial ::= SEQUENCE {k1 INTEGER,
k2 INTEGER,
k3 INTEGER}-- characteric two general irreducible polynomial representation-- the irreducible polymial-- a(n)*x^n + a(n-1)*x^(n-1) + ... + a(1)*x + a(0)-- is encoded in the bit string with a(n) in the first bit, the-- following coefficients in the following bit positions and a(0)-- in the last bit of the bit string (one could omit a(n) and a(0)-- but it may be simpler and less error-prone to leave them in-- the encoding)-- the degree of the polynomial is to be inferred from the length-- of the bit string
CharTwoPolynomial ::= BIT STRING-- odd characteristic extension fields
ODD-CHARACTERISTIC ::= TYPE-IDENTIFIER
Odd-characteristic ::= SEQUENCE {characteristic INTEGER(3..MAX),
degree INTEGER(2..MAX),
basis ODD-CHARACTERISTIC.&id({OddCharBasisTypes}),parameters ODD-CHARACTERISTIC.&Type({OddCharBasisTypes}{@basis})}
OddCharBasisTypes ODD-CHARACTERISTIC ::= {{ OddCharPolynomial IDENTIFIED BY oddCharPolynomialBasis },... -- expect additional basis types}-- the monic irreducible polynomial is encoded as follows-- the leading coefficient is ignored-- the remaining coefficients define an element of the finite field-- which is encoded in an octet string using FE2OSP
OddCharPolynomial ::= FieldElement
EllipticCurveSubgroupParameters ::= SEQUENCE {21

version INTEGER { ecpVer1(1) } (ecpVer1),
fieldID FieldID {{ FieldTypes }},curve Curve,
generator ECPoint,-- Base point G
subgroupOrder INTEGER, -- Order mu of the base point
subgroupIndex INTEGER, -- The integer nu = #E(F)/mu...
}
Curve ::= SEQUENCE {aCoeff FieldElement,bCoeff FieldElement,
seed BIT STRING OPTIONAL}--###################################################################-- auxiliary definitions
FieldElement ::= OCTET STRING -- obtained through FE2OSPECPoint ::= OCTET STRING -- obtained through EC2OSPKeyLength ::= INTEGER (1..MAX)
MacAlgorithm ::= AlgorithmIdentifier {{ MACAlgorithms }}MACAlgorithms ALGORITHM ::= {{ OID hMAC-SHA1 PARMS NULL } ,... -- Expect additional algorithms -}HashFunction ::= AlgorithmIdentifier {{ HashFunctionAlgorithms }}HashFunctionAlgorithms ALGORITHM ::= {HashFunctionAlgs | -- from 10118-3{ NULL IDENTIFIED BY id-itu-sha1 } |{ NULL IDENTIFIED BY id-itu-sha224 } |{ NULL IDENTIFIED BY id-itu-sha256 } |{ NULL IDENTIFIED BY id-itu-sha384 } |{ NULL IDENTIFIED BY id-itu-sha512 },... -- expect additional algorithms}
KeyDerivationFunction ::= AlgorithmIdentifier {{ KDFAlgorithms }}KDFAlgorithms ALGORITHM ::= {{ OID id-kdf-kdf1 PARMS HashFunction } |{ OID id-kdf-kdf2 PARMS HashFunction } |{ OID id-mgf1 PARMS HashFunction },... -- Expect additional algorithms -}SymmetricCipher ::= AlgorithmIdentifier {{ SymmetricAlgorithms }}SymmetricAlgorithms ALGORITHM ::= {{ OID id-sc-sc1 PARMS BlockCipher } |{ OID id-sc-sc2 PARMS BlockCipher } |{ OID id-camellia128-cbc PARMS BlockCipher } |{ OID id-aes128-CBC PARMS BlockCipher },... -- Expect additional algorithms -}BlockCipher ::= AlgorithmIdentifier {{ BlockAlgorithms }}22

--###################################################################-- external OIDs-- HMAC-SHA1
hMAC-SHA1 OID ::= {iso(1) identified-organization(3) dod(6) internet(1) security(5)mechanisms(5) 8 1 2 }-- X9.62 finite field and basis types
ansi-X9-62 OID ::= { iso(1) member-body(2) us(840) 10045 }
id-fieldType OID ::= { ansi-X9-62 fieldType(1) }prime-field OID ::= { id-fieldType 1 }characteristic-two-field OID ::= { id-fieldType 2 }-- characteristic two basis
id-characteristic-two-basis OID ::= { characteristic-two-fieldbasisType(3) }gnBasis OID ::= { id-characteristic-two-basis 1 }tpBasis OID ::= { id-characteristic-two-basis 2 }ppBasis OID ::= { id-characteristic-two-basis 3 }--###################################################################-- Cryptographic algorithm identification -ALGORITHM ::= CLASS {&id OBJECT IDENTIFIER UNIQUE,&Type OPTIONAL}
WITH SYNTAX { OID &id [PARMS &Type] }AlgorithmIdentifier { ALGORITHM:IOSet } ::= SEQUENCE {algorithm ALGORITHM.&id( {IOSet} ),parameters ALGORITHM.&Type( {IOSet}{@algorithm} ) OPTIONAL}
END -- EncryptionAlgorithms-2 --23