X-Wing
Purpose
When communicating with another party, you often need a way to establish a shared secret (symmetric) key without having an existing secure channel. An algorithm that allows this over a public (insecure) channel is called a key-establishment scheme.
Key encapsulation mechanisms (KEMs) are one type of key-establishment scheme, and they're the design of choice for post-quantum algorithms. Unlike a traditional key exchange, the sender's key pair isn't involved, a ciphertext needs to be sent to the recipient, and the shared secret is uniformly random. From the sending side, the algorithm is randomised rather than deterministic.
Here is how it works when doing one trip of communication:
Key generation: Alice generates a key pair.
Encapsulation: Bob uses Alice's public key to generate a shared secret and an associated ciphertext. This ciphertext is sent to Alice.
Decapsulation: Alice uses the ciphertext and her private key to compute the same shared secret.
X-Wing is designed to be the sensible, interoperable hybrid (post-quantum + traditional security) KEM for most applications. There are no variants, and it provides a 128-bit security level. The design includes optimisations, combines popular algorithms, and hedges against cryptanalysis advancements.
Private keys MUST NOT be shared. They MUST remain secret.
Usage
GenerateKeyPair
Fills a span with a randomly generated private key and another span with the associated public key.
XWing.GenerateKeyPair(Span<byte> publicKey, Span<byte> privateKey);Exceptions
publicKey has a length not equal to PublicKeySize.
privateKey has a length not equal to PrivateKeySize.
Error generating key pair.
GenerateKeyPair
Fills a span with a private key generated using a random seed and another span with the associated public key.
Exceptions
publicKey has a length not equal to PublicKeySize.
privateKey has a length not equal to PrivateKeySize.
seed has a length not equal to SeedSize.
Error generating key pair from seed.
Encapsulate
Fills a span with the computed shared secret and another span with the ciphertext to send to the recipient based on the recipient's public key.
Exceptions
sharedSecret has a length not equal to SharedSecretSize.
ciphertext has a length not equal to CiphertextSize.
recipientPublicKey has a length not equal to PublicKeySize.
Invalid public key.
Decapsulate
Fills a span with the computed shared secret based on the recipient's private key and the ciphertext the recipient was sent.
Exceptions
sharedSecret has a length not equal to SharedSecretSize.
ciphertext has a length not equal to CiphertextSize.
recipientPrivateKey has a length not equal to PrivateKeySize.
Invalid ciphertext.
Constants
These are used for validation and/or save you defining your own constants.
Notes
Not all uses of traditional key exchange can be replaced in a straightforward manner by KEMs. X-Wing doesn't provide non-interactive key exchange (NIKE) or authenticated KEM functionality.
If you read about post-quantum algorithms, you may see the terms 'encapsulation key' and 'decapsulation key'. These mean 'public key' and 'private key' but are specific to KEMs.
X-Wing uses X25519/ML-KEM-768 for key establishment and SHAKE256/SHA3-256 as KDFs.
The private key is a seed that gets expanded to derive ML-KEM and X25519 key pairs. The public key, ciphertext, and shared secret are the result of concatenating X25519 and ML-KEM-768 values together.
Last updated