We are migrating away from ECDH towards a post-quantum method. This involves the usage of key encapsulation, and where we generate a secret key which is encapsulated by a public key and then decapsulated by an associated private key. While ML-KEM is the method of choice at the moment, it is likely that we will use a hybrid method, such as ML-KEM768 and X25519.
X-Wing is one solution to this, and is optimised to use X25519 and ML-KEM-768 [here][1]:
Press enter or click to view image in full size
Overall, the paper demonstrates that X-Wing exhibits excellent performance levels and is secure if either X25519 or ML-KEM-768 is secure. The main difference between X-Wing and the X25519Kyber768 standard [here] is:
Uses the final version of ML-KEM-768.
Creates hashes of the shared secrets, which can be used away from the hybrid encryption.
A simpler combiner which flattens DHKEM(X25519) into a hash.
Does not hash the ML-KEM-768 ciphertext.
At the present time, X-Wing is being drafted by the IETF [here]:
Professor of Cryptography. Serial innovator. Believer in fairness, justice & freedom. Based in Edinburgh. Old World Breaker. New World Creator. Building trust.
