From 5713055c18b16a123024c5713dd39c5370f7d51c Mon Sep 17 00:00:00 2001
From: ID Bot <idbot@example.com>
Date: Tue, 22 Oct 2024 00:03:17 +0000
Subject: [PATCH] Script updating gh-pages from 7499507. [ci skip]

---
 ...> draft-irtf-cfrg-generic-hybrid-kems.html | 443 ++++++++++++++----
 draft-irtf-cfrg-generic-hybrid-kems.txt       | 283 +++++++++++
 draft-irtf-cfrg-hybrid-kems.txt               | 155 ------
 index.html                                    |  14 +-
 4 files changed, 644 insertions(+), 251 deletions(-)
 rename draft-irtf-cfrg-hybrid-kems.html => draft-irtf-cfrg-generic-hybrid-kems.html (60%)
 create mode 100644 draft-irtf-cfrg-generic-hybrid-kems.txt
 delete mode 100644 draft-irtf-cfrg-hybrid-kems.txt

diff --git a/draft-irtf-cfrg-hybrid-kems.html b/draft-irtf-cfrg-generic-hybrid-kems.html
similarity index 60%
rename from draft-irtf-cfrg-hybrid-kems.html
rename to draft-irtf-cfrg-generic-hybrid-kems.html
index 7497563..caa5cae 100644
--- a/draft-irtf-cfrg-hybrid-kems.html
+++ b/draft-irtf-cfrg-generic-hybrid-kems.html
@@ -4,31 +4,32 @@
 <meta charset="utf-8">
 <meta content="Common,Latin" name="scripts">
 <meta content="initial-scale=1.0" name="viewport">
-<title>Hybrid PQ/T Key Encapsulation Mechanisms</title>
+<title>Generic Hybrid PQ/T Key Encapsulation Mechanisms</title>
 <meta content="Deirdre Connolly" name="author">
-<meta content="Bas Westerbaan" name="author">
-<meta content="Britta Hale" name="author">
 <meta content="
-       TODO Abstract 
+       This document defines generic techniques to achive hybrid PQ-T key
+encapsulation mechanisms (KEMs) from post-quantum and traditional component
+algorithms that meet specified security properties. Concrete instatiations of
+techniques are located in another document. 
     " name="description">
-<meta content="xml2rfc 3.23.0" name="generator">
-<meta content="draft-irtf-cfrg-hybrid-kems-latest" name="ietf.draft">
+<meta content="xml2rfc 3.23.2" name="generator">
+<meta content="draft-irtf-cfrg-generic-hybrid-kems-latest" name="ietf.draft">
 <!-- Generator version information:
-  xml2rfc 3.23.0
-    Python 3.12.3
+  xml2rfc 3.23.2
+    Python 3.12.7
     ConfigArgParse 1.7
-    google-i18n-address 3.1.0
+    google-i18n-address 3.1.1
     intervaltree 3.1.0
     Jinja2 3.1.4
     lxml 4.9.4
-    platformdirs 4.2.2
+    platformdirs 4.3.6
     pycountry 22.3.5
     PyYAML 6.0.1
     requests 2.32.3
     setuptools 70.3.0
     wcwidth 0.2.13
 -->
-<link href="draft-irtf-cfrg-hybrid-kems.xml" rel="alternate" type="application/rfc+xml">
+<link href="draft-irtf-cfrg-generic-hybrid-kems.xml" rel="alternate" type="application/rfc+xml">
 <link href="#copyright" rel="license">
 <style type="text/css">@font-face {
   font-family: 'Lora';
@@ -1024,12 +1025,12 @@
 <table class="ears">
 <thead><tr>
 <td class="left">Internet-Draft</td>
-<td class="center">hybrid-kems</td>
-<td class="right">September 2024</td>
+<td class="center">generic-hybrid-kems</td>
+<td class="right">October 2024</td>
 </tr></thead>
 <tfoot><tr>
-<td class="left">Connolly, et al.</td>
-<td class="center">Expires 18 March 2025</td>
+<td class="left">Connolly</td>
+<td class="center">Expires 25 April 2025</td>
 <td class="right">[Page]</td>
 </tr></tfoot>
 </table>
@@ -1039,36 +1040,31 @@
 <dt class="label-workgroup">Workgroup:</dt>
 <dd class="workgroup">Crypto Forum</dd>
 <dt class="label-internet-draft">Internet-Draft:</dt>
-<dd class="internet-draft">draft-irtf-cfrg-hybrid-kems-latest</dd>
+<dd class="internet-draft">draft-irtf-cfrg-generic-hybrid-kems-latest</dd>
 <dt class="label-published">Published:</dt>
 <dd class="published">
-<time datetime="2024-09-14" class="published">14 September 2024</time>
+<time datetime="2024-10-22" class="published">22 October 2024</time>
     </dd>
 <dt class="label-intended-status">Intended Status:</dt>
 <dd class="intended-status">Informational</dd>
 <dt class="label-expires">Expires:</dt>
-<dd class="expires"><time datetime="2025-03-18">18 March 2025</time></dd>
-<dt class="label-authors">Authors:</dt>
+<dd class="expires"><time datetime="2025-04-25">25 April 2025</time></dd>
+<dt class="label-authors">Author:</dt>
 <dd class="authors">
 <div class="author">
       <div class="author-name">D. Connolly</div>
 <div class="org">SandboxAQ</div>
 </div>
-<div class="author">
-      <div class="author-name">B. E. Westerbaan</div>
-<div class="org">Cloudflare</div>
-</div>
-<div class="author">
-      <div class="author-name">B. Hale</div>
-<div class="org">Naval Postgraduate School</div>
-</div>
 </dd>
 </dl>
 </div>
-<h1 id="title">Hybrid PQ/T Key Encapsulation Mechanisms</h1>
+<h1 id="title">Generic Hybrid PQ/T Key Encapsulation Mechanisms</h1>
 <section id="section-abstract">
       <h2 id="abstract"><a href="#abstract" class="selfRef">Abstract</a></h2>
-<p id="section-abstract-1">TODO Abstract<a href="#section-abstract-1" class="pilcrow">¶</a></p>
+<p id="section-abstract-1">This document defines generic techniques to achive hybrid PQ-T key
+encapsulation mechanisms (KEMs) from post-quantum and traditional component
+algorithms that meet specified security properties. Concrete instatiations of
+techniques are located in another document.<a href="#section-abstract-1" class="pilcrow">¶</a></p>
 </section>
 <section class="note rfcEditorRemove" id="section-note.1">
       <h2 id="name-discussion-venues">
@@ -1100,7 +1096,7 @@ <h2 id="name-status-of-this-memo">
         time. It is inappropriate to use Internet-Drafts as reference
         material or to cite them other than as "work in progress."<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
 <p id="section-boilerplate.1-4">
-        This Internet-Draft will expire on 18 March 2025.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
+        This Internet-Draft will expire on 25 April 2025.<a href="#section-boilerplate.1-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="copyright">
@@ -1127,62 +1123,178 @@ <h2 id="name-copyright-notice">
         </h2>
 <nav class="toc"><ul class="compact toc ulBare ulEmpty">
 <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1">
-            <p id="section-toc.1-1.1.1" class="keepWithNext"><a href="#section-1" class="auto internal xref">1</a>.  <a href="#name-introduction" class="internal xref">Introduction</a></p>
+            <p id="section-toc.1-1.1.1"><a href="#section-1" class="auto internal xref">1</a>.  <a href="#name-introduction" class="internal xref">Introduction</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.1">
+                <p id="section-toc.1-1.1.2.1.1" class="keepWithNext"><a href="#section-1.1" class="auto internal xref">1.1</a>.  <a href="#name-motivation" class="internal xref">Motivation</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.2">
+                <p id="section-toc.1-1.1.2.2.1"><a href="#section-1.2" class="auto internal xref">1.2</a>.  <a href="#name-design-goals" class="internal xref">Design goals</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.2.2.1">
+                    <p id="section-toc.1-1.1.2.2.2.1.1" class="keepWithNext"><a href="#section-1.2.1" class="auto internal xref">1.2.1</a>.  <a href="#name-non-iteractive" class="internal xref">Non-iteractive</a></p>
+</li>
+                  <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.2.2.2">
+                    <p id="section-toc.1-1.1.2.2.2.2.1" class="keepWithNext"><a href="#section-1.2.2" class="auto internal xref">1.2.2</a>.  <a href="#name-not-authenticated" class="internal xref">Not authenticated</a></p>
+</li>
+                </ul>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.1.2.3">
+                <p id="section-toc.1-1.1.2.3.1"><a href="#section-1.3" class="auto internal xref">1.3</a>.  <a href="#name-design-non-goals" class="internal xref">Design Non-Goals</a></p>
+</li>
+            </ul>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.2">
-            <p id="section-toc.1-1.2.1" class="keepWithNext"><a href="#section-2" class="auto internal xref">2</a>.  <a href="#name-conventions-and-definitions" class="internal xref">Conventions and Definitions</a></p>
+            <p id="section-toc.1-1.2.1"><a href="#section-2" class="auto internal xref">2</a>.  <a href="#name-conventions-and-definitions" class="internal xref">Conventions and Definitions</a></p>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.3">
-            <p id="section-toc.1-1.3.1" class="keepWithNext"><a href="#section-3" class="auto internal xref">3</a>.  <a href="#name-security-considerations" class="internal xref">Security Considerations</a></p>
+            <p id="section-toc.1-1.3.1"><a href="#section-3" class="auto internal xref">3</a>.  <a href="#name-conventions-and-definitions-2" class="internal xref">Conventions and Definitions</a></p>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4">
-            <p id="section-toc.1-1.4.1"><a href="#section-4" class="auto internal xref">4</a>.  <a href="#name-iana-considerations" class="internal xref">IANA Considerations</a></p>
+            <p id="section-toc.1-1.4.1"><a href="#section-4" class="auto internal xref">4</a>.  <a href="#name-hybrid-kem-security-propert" class="internal xref">Hybrid KEM Security Properties</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.1">
+                <p id="section-toc.1-1.4.2.1.1"><a href="#section-4.1" class="auto internal xref">4.1</a>.  <a href="#name-ind-cca-security" class="internal xref">IND-CCA security</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.2">
+                <p id="section-toc.1-1.4.2.2.1"><a href="#section-4.2" class="auto internal xref">4.2</a>.  <a href="#name-leak-bind-k-pk-security" class="internal xref">LEAK-BIND-K-PK security</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.4.2.3">
+                <p id="section-toc.1-1.4.2.3.1"><a href="#section-4.3" class="auto internal xref">4.3</a>.  <a href="#name-leak-bind-k-ct-security" class="internal xref">LEAK-BIND-K-CT security</a></p>
+</li>
+            </ul>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5">
-            <p id="section-toc.1-1.5.1"><a href="#section-5" class="auto internal xref">5</a>.  <a href="#name-normative-references" class="internal xref">Normative References</a></p>
+            <p id="section-toc.1-1.5.1"><a href="#section-5" class="auto internal xref">5</a>.  <a href="#name-hybrid-kem-construction-tec" class="internal xref">Hybrid KEM Construction Techniques</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5.2.1">
+                <p id="section-toc.1-1.5.2.1.1"><a href="#section-5.1" class="auto internal xref">5.1</a>.  <a href="#name-kdf-as-a-secure-prf" class="internal xref">KDF as a secure PRF</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5.2.2">
+                <p id="section-toc.1-1.5.2.2.1"><a href="#section-5.2" class="auto internal xref">5.2</a>.  <a href="#name-ind-cca-secure-pq-kem" class="internal xref">IND-CCA-secure PQ KEM</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5.2.3">
+                <p id="section-toc.1-1.5.2.3.1"><a href="#section-5.3" class="auto internal xref">5.3</a>.  <a href="#name-kitchen-sink-construction" class="internal xref">'Kitchen Sink' construction:</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.5.2.4">
+                <p id="section-toc.1-1.5.2.4.1"><a href="#section-5.4" class="auto internal xref">5.4</a>.  <a href="#name-x-wing-construction" class="internal xref">'X-Wing' construction</a></p>
+</li>
+            </ul>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.6">
-            <p id="section-toc.1-1.6.1"><a href="#appendix-A" class="auto internal xref"></a><a href="#name-acknowledgments" class="internal xref">Acknowledgments</a></p>
+            <p id="section-toc.1-1.6.1"><a href="#section-6" class="auto internal xref">6</a>.  <a href="#name-hybrid-kem-instatiations" class="internal xref">Hybrid KEM Instatiations</a></p>
 </li>
           <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.7">
-            <p id="section-toc.1-1.7.1"><a href="#appendix-B" class="auto internal xref"></a><a href="#name-authors-addresses" class="internal xref">Authors' Addresses</a></p>
+            <p id="section-toc.1-1.7.1"><a href="#section-7" class="auto internal xref">7</a>.  <a href="#name-security-considerations" class="internal xref">Security Considerations</a></p>
+</li>
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.8">
+            <p id="section-toc.1-1.8.1"><a href="#section-8" class="auto internal xref">8</a>.  <a href="#name-iana-considerations" class="internal xref">IANA Considerations</a></p>
+</li>
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.9">
+            <p id="section-toc.1-1.9.1"><a href="#section-9" class="auto internal xref">9</a>.  <a href="#name-references" class="internal xref">References</a></p>
+<ul class="compact toc ulBare ulEmpty">
+<li class="compact toc ulBare ulEmpty" id="section-toc.1-1.9.2.1">
+                <p id="section-toc.1-1.9.2.1.1"><a href="#section-9.1" class="auto internal xref">9.1</a>.  <a href="#name-normative-references" class="internal xref">Normative References</a></p>
+</li>
+              <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.9.2.2">
+                <p id="section-toc.1-1.9.2.2.1"><a href="#section-9.2" class="auto internal xref">9.2</a>.  <a href="#name-informative-references" class="internal xref">Informative References</a></p>
+</li>
+            </ul>
+</li>
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.10">
+            <p id="section-toc.1-1.10.1"><a href="#appendix-A" class="auto internal xref"></a><a href="#name-acknowledgments" class="internal xref">Acknowledgments</a></p>
+</li>
+          <li class="compact toc ulBare ulEmpty" id="section-toc.1-1.11">
+            <p id="section-toc.1-1.11.1"><a href="#appendix-B" class="auto internal xref"></a><a href="#name-authors-address" class="internal xref">Author's Address</a></p>
 </li>
         </ul>
 </nav>
 </section>
 </div>
-<div id="introduction">
+<div id="intro">
 <section id="section-1">
       <h2 id="name-introduction">
 <a href="#section-1" class="section-number selfRef">1. </a><a href="#name-introduction" class="section-name selfRef">Introduction</a>
       </h2>
-<p id="section-1-1">We propose "Hybrid PQ/T Key Encapsulation Mechanisms", which will cover the following.<a href="#section-1-1" class="pilcrow">¶</a></p>
-<p id="section-1-2">(A) Identify which KEM security properties are IETF-relevant, and provide a terse overview of those
+<div id="motivation">
+<section id="section-1.1">
+        <h3 id="name-motivation">
+<a href="#section-1.1" class="section-number selfRef">1.1. </a><a href="#name-motivation" class="section-name selfRef">Motivation</a>
+        </h3>
+<p id="section-1.1-1">There are many choices that can be made when specifying a hybrid KEM:
+the constituent KEMs; their security levels; the combiner; and the hash
+within, to name but a few. Having too many similar options are a burden
+to the ecosystem.<a href="#section-1.1-1" class="pilcrow">¶</a></p>
+<p id="section-1.1-2">The aim of this document is provide a small set of techniques for constructing
+hybrid KEMs designed to achieve specific security properties given conforming
+component algorithms,  that should be suitable for the vast majority of use cases.<a href="#section-1.1-2" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="goals">
+<section id="section-1.2">
+        <h3 id="name-design-goals">
+<a href="#section-1.2" class="section-number selfRef">1.2. </a><a href="#name-design-goals" class="section-name selfRef">Design goals</a>
+        </h3>
+<ul class="normal">
+<li class="normal" id="section-1.2-1.1">
+            <p id="section-1.2-1.1.1">Identify which KEM security properties are IETF-relevant, and provide a terse overview of those
 security properties (eg. IND-CCA, LEAK-BIND-K-PK, HON-BIND-K-CT, etc), as well as security
 properties unique to hybrid KEMs (component key material reuse between hybrid and non-hybrid uses or
 between multiple hybrids, one component is malicious while the other is honest, etc) with reference
 to literature, and put into context with real-world attacks. From that, give guidance on a sensible
-baseline.<a href="#section-1-2" class="pilcrow">¶</a></p>
-<p id="section-1-3">(B) Provide a terse overview of well-reviewed techniques that are options to safely produce the
+baseline.<a href="#section-1.2-1.1.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-1.2-1.2">
+            <p id="section-1.2-1.2.1">Provide a terse overview of well-reviewed techniques that are options to safely produce the
 concrete combinations in (C), and which security properties are achieved given those of the
-constituents.<a href="#section-1-3" class="pilcrow">¶</a></p>
-<p id="section-1-4">(C) Provide an initial number of explicit PQ/T hybrid KEMs using techniques from (B) that reach the
-baseline set in (A), in a separate document, and should include:<a href="#section-1-4" class="pilcrow">¶</a></p>
-<div class="alignLeft art-text artwork" id="section-1-5">
+constituents.<a href="#section-1.2-1.2.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-1.2-1.3">
+            <p id="section-1.2-1.3.1">Provide an initial number of explicit PQ/T hybrid KEMs using techniques from (B) that reach the
+baseline set in (A), in a separate document, and should include:<a href="#section-1.2-1.3.1" class="pilcrow">¶</a></p>
+<div class="alignLeft art-text artwork" id="section-1.2-1.3.2">
 <pre>
-   (I)  a hybrid of P-256 and ML-KEM-768,
-   (II)  a hybrid of X25519 and ML-KEM-768, and,
-   (III) a hybrid of P-384 and ML-KEM-1024.
-</pre><a href="#section-1-5" class="pilcrow">¶</a>
+ (I)  a hybrid of P-256 and ML-KEM-768,
+ (II)  a hybrid of X25519 and ML-KEM-768, and,
+ (III) a hybrid of P-384 and ML-KEM-1024.
+</pre><a href="#section-1.2-1.3.2" class="pilcrow">¶</a>
 </div>
-<p id="section-1-6">These hybrids should be accompanied by pseudocode and test vectors.<a href="#section-1-6" class="pilcrow">¶</a></p>
-<p id="section-1-7">This list includes two options at the ~128-bit security level (due to current
-implementation/deployment trends) and one at a higher level.<a href="#section-1-7" class="pilcrow">¶</a></p>
-<p id="section-1-8">There is demand for other hybrid variants that either use different
+</li>
+        </ul>
+<p id="section-1.2-2">These hybrids should be accompanied by pseudocode and test vectors.<a href="#section-1.2-2" class="pilcrow">¶</a></p>
+<p id="section-1.2-3">This list includes two options at the ~128-bit security level (due to current
+implementation/deployment trends) and one at a higher level.<a href="#section-1.2-3" class="pilcrow">¶</a></p>
+<div id="non-iteractive">
+<section id="section-1.2.1">
+          <h4 id="name-non-iteractive">
+<a href="#section-1.2.1" class="section-number selfRef">1.2.1. </a><a href="#name-non-iteractive" class="section-name selfRef">Non-iteractive</a>
+          </h4>
+<p id="section-1.2.1-1">These KEMs are a non-interactive means to establish a shared secret.
+Using KEMs in place of Diffie-Hellman key exchange can be done in some settings
+but not all.<a href="#section-1.2.1-1" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="not-authenticated">
+<section id="section-1.2.2">
+          <h4 id="name-not-authenticated">
+<a href="#section-1.2.2" class="section-number selfRef">1.2.2. </a><a href="#name-not-authenticated" class="section-name selfRef">Not authenticated</a>
+          </h4>
+<p id="section-1.2.2-1">These KEMs are not <em>authenticated</em>.<a href="#section-1.2.2-1" class="pilcrow">¶</a></p>
+</section>
+</div>
+</section>
+</div>
+<div id="design-non-goals">
+<section id="section-1.3">
+        <h3 id="name-design-non-goals">
+<a href="#section-1.3" class="section-number selfRef">1.3. </a><a href="#name-design-non-goals" class="section-name selfRef">Design Non-Goals</a>
+        </h3>
+<p id="section-1.3-1">There is demand for other hybrid variants that either use different
 primitives (RSA, NTRU, Classic McEliece, FrodoKEM), parameters, or that
-use a combiner optimized for a specific use case. The DT recommends the
-work outlined in (C) is done in a first document, and other use cases
-could be covered in subsequent documents.<a href="#section-1-8" class="pilcrow">¶</a></p>
+use a combiner optimized for a specific use case. Other use cases
+could be covered in subsequent documents and not included here.<a href="#section-1.3-1" class="pilcrow">¶</a></p>
+</section>
+</div>
 </section>
 </div>
 <div id="conventions-and-definitions">
@@ -1196,41 +1308,210 @@ <h2 id="name-conventions-and-definitions">
 appear in all capitals, as shown here.<a href="#section-2-1" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="security-considerations">
+<div id="conventions-and-definitions-1">
 <section id="section-3">
+      <h2 id="name-conventions-and-definitions-2">
+<a href="#section-3" class="section-number selfRef">3. </a><a href="#name-conventions-and-definitions-2" class="section-name selfRef">Conventions and Definitions</a>
+      </h2>
+<p id="section-3-1">This document is consistent with all terminology defined in
+<span>[<a href="#I-D.driscoll-pqt-hybrid-terminology" class="cite xref">I-D.driscoll-pqt-hybrid-terminology</a>]</span>.<a href="#section-3-1" class="pilcrow">¶</a></p>
+<p id="section-3-2">The following terms are used throughout this document to describe the
+operations, roles, and behaviors of HPKE:<a href="#section-3-2" class="pilcrow">¶</a></p>
+<ul class="normal">
+<li class="normal" id="section-3-3.1">
+          <p id="section-3-3.1.1"><code>concat(x0, ..., xN)</code>: returns the concatenation of byte
+strings. <code>concat(0x01, 0x0203, 0x040506) = 0x010203040506</code>.<a href="#section-3-3.1.1" class="pilcrow">¶</a></p>
+</li>
+        <li class="normal" id="section-3-3.2">
+          <p id="section-3-3.2.1"><code>random(n)</code>: return a pseudorandom byte string of length <code>n</code> bytes produced by
+a cryptographically-secure random number generator.<a href="#section-3-3.2.1" class="pilcrow">¶</a></p>
+</li>
+      </ul>
+</section>
+</div>
+<div id="hybrid-kem-security-properties">
+<section id="section-4">
+      <h2 id="name-hybrid-kem-security-propert">
+<a href="#section-4" class="section-number selfRef">4. </a><a href="#name-hybrid-kem-security-propert" class="section-name selfRef">Hybrid KEM Security Properties</a>
+      </h2>
+<p id="section-4-1">Hybrid KEM constructions ideally provide at least:<a href="#section-4-1" class="pilcrow">¶</a></p>
+<div id="ind-cca-security">
+<section id="section-4.1">
+        <h3 id="name-ind-cca-security">
+<a href="#section-4.1" class="section-number selfRef">4.1. </a><a href="#name-ind-cca-security" class="section-name selfRef">IND-CCA security</a>
+        </h3>
+<p id="section-4.1-1">Also known as IND-CCA1 security for general public key encryption, for KEMs
+that encapsulate a new random 'message' each time,<a href="#section-4.1-1" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="leak-bind-k-pk-security">
+<section id="section-4.2">
+        <h3 id="name-leak-bind-k-pk-security">
+<a href="#section-4.2" class="section-number selfRef">4.2. </a><a href="#name-leak-bind-k-pk-security" class="section-name selfRef">LEAK-BIND-K-PK security</a>
+      </h3>
+</section>
+</div>
+<div id="leak-bind-k-ct-security">
+<section id="section-4.3">
+        <h3 id="name-leak-bind-k-ct-security">
+<a href="#section-4.3" class="section-number selfRef">4.3. </a><a href="#name-leak-bind-k-ct-security" class="section-name selfRef">LEAK-BIND-K-CT security</a>
+        </h3>
+<p id="section-4.3-1">The shared secret<a href="#section-4.3-1" class="pilcrow">¶</a></p>
+</section>
+</div>
+</section>
+</div>
+<div id="hybrid-kem-construction-techniques">
+<section id="section-5">
+      <h2 id="name-hybrid-kem-construction-tec">
+<a href="#section-5" class="section-number selfRef">5. </a><a href="#name-hybrid-kem-construction-tec" class="section-name selfRef">Hybrid KEM Construction Techniques</a>
+      </h2>
+<p id="section-5-1">Requirements:<a href="#section-5-1" class="pilcrow">¶</a></p>
+<div id="kdf-as-a-secure-prf">
+<section id="section-5.1">
+        <h3 id="name-kdf-as-a-secure-prf">
+<a href="#section-5.1" class="section-number selfRef">5.1. </a><a href="#name-kdf-as-a-secure-prf" class="section-name selfRef">KDF as a secure PRF</a>
+      </h3>
+</section>
+</div>
+<div id="ind-cca-secure-pq-kem">
+<section id="section-5.2">
+        <h3 id="name-ind-cca-secure-pq-kem">
+<a href="#section-5.2" class="section-number selfRef">5.2. </a><a href="#name-ind-cca-secure-pq-kem" class="section-name selfRef">IND-CCA-secure PQ KEM</a>
+      </h3>
+</section>
+</div>
+<div id="kitchen-sink-construction">
+<section id="section-5.3">
+        <h3 id="name-kitchen-sink-construction">
+<a href="#section-5.3" class="section-number selfRef">5.3. </a><a href="#name-kitchen-sink-construction" class="section-name selfRef">'Kitchen Sink' construction:</a>
+        </h3>
+<p id="section-5.3-1">Ingredients:<a href="#section-5.3-1" class="pilcrow">¶</a></p>
+<ul class="normal">
+<li class="normal" id="section-5.3-2.1">
+            <p id="section-5.3-2.1.1">KDF <code>F</code><a href="#section-5.3-2.1.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.2">
+            <p id="section-5.3-2.2.1">label<a href="#section-5.3-2.2.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.3">
+            <p id="section-5.3-2.3.1">PQ-CT<a href="#section-5.3-2.3.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.4">
+            <p id="section-5.3-2.4.1">PQ-PK<a href="#section-5.3-2.4.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.5">
+            <p id="section-5.3-2.5.1">PQ-SS<a href="#section-5.3-2.5.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.6">
+            <p id="section-5.3-2.6.1">T-PK<a href="#section-5.3-2.6.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.7">
+            <p id="section-5.3-2.7.1">T-CT<a href="#section-5.3-2.7.1" class="pilcrow">¶</a></p>
+</li>
+          <li class="normal" id="section-5.3-2.8">
+            <p id="section-5.3-2.8.1">T-SS<a href="#section-5.3-2.8.1" class="pilcrow">¶</a></p>
+</li>
+        </ul>
+<div class="alignLeft art-text artwork" id="section-5.3-3">
+<pre>
+def SharedSecret():
+    return F(concat(PQ_SS, T_SS, PQ_CT, PQ_PK, T_CT, T_PK, label))
+</pre><a href="#section-5.3-3" class="pilcrow">¶</a>
+</div>
+<p id="section-5.3-4">Label varies per combos such that the label will vary as the lengths and
+other properties of the component algorithms vary. Otherwise we'd have to
+hash the inputs to fixed lengths or encode lengths into the input.<a href="#section-5.3-4" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="x-wing-construction">
+<section id="section-5.4">
+        <h3 id="name-x-wing-construction">
+<a href="#section-5.4" class="section-number selfRef">5.4. </a><a href="#name-x-wing-construction" class="section-name selfRef">'X-Wing' construction</a>
+        </h3>
+<p id="section-5.4-1">Inspired by [XWING] which leverages the security properties of a KEM like
+ML-KEM to elide other public data from the KDF input.<a href="#section-5.4-1" class="pilcrow">¶</a></p>
+<div class="alignLeft art-text artwork" id="section-5.4-2">
+<pre>
+def SharedSecret():
+    return F(concat(label, T_SS, PQ_SS, T_CT, T_PK))
+</pre><a href="#section-5.4-2" class="pilcrow">¶</a>
+</div>
+<p id="section-5.4-3">Relies on PQ KEM having LEAK-BIND-K-CT and LEAK-BIND-K-PK security, which is
+related to the collision-freeness of the underlying PKE scheme of a
+FO-transform KEM like ML-KEM.<a href="#section-5.4-3" class="pilcrow">¶</a></p>
+</section>
+</div>
+</section>
+</div>
+<div id="hybrid-kem-instatiations">
+<section id="section-6">
+      <h2 id="name-hybrid-kem-instatiations">
+<a href="#section-6" class="section-number selfRef">6. </a><a href="#name-hybrid-kem-instatiations" class="section-name selfRef">Hybrid KEM Instatiations</a>
+      </h2>
+<p id="section-6-1">See the other document.<a href="#section-6-1" class="pilcrow">¶</a></p>
+</section>
+</div>
+<div id="security-considerations">
+<section id="section-7">
       <h2 id="name-security-considerations">
-<a href="#section-3" class="section-number selfRef">3. </a><a href="#name-security-considerations" class="section-name selfRef">Security Considerations</a>
+<a href="#section-7" class="section-number selfRef">7. </a><a href="#name-security-considerations" class="section-name selfRef">Security Considerations</a>
       </h2>
-<p id="section-3-1">IND-CCA, LEAK-BIND-K-PK, etc, as well as security properties unique to hybrid KEMs (component key
-material reuse between hybrid and non-hybrid uses or between multiple hybrids, one component is
-malicious while the other is honest, etc)<a href="#section-3-1" class="pilcrow">¶</a></p>
+<p id="section-7-1">IND-CCA, LEAK-BIND-K-PK, etc, as well as security properties unique to hybrid
+KEMs (component key material reuse between hybrid and non-hybrid uses or
+between multiple hybrids, one component is malicious while the other is
+honest, etc)<a href="#section-7-1" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="iana-considerations">
-<section id="section-4">
+<section id="section-8">
       <h2 id="name-iana-considerations">
-<a href="#section-4" class="section-number selfRef">4. </a><a href="#name-iana-considerations" class="section-name selfRef">IANA Considerations</a>
+<a href="#section-8" class="section-number selfRef">8. </a><a href="#name-iana-considerations" class="section-name selfRef">IANA Considerations</a>
       </h2>
-<p id="section-4-1">This document has no IANA actions.<a href="#section-4-1" class="pilcrow">¶</a></p>
+<p id="section-8-1">This document has no IANA actions.<a href="#section-8-1" class="pilcrow">¶</a></p>
 </section>
 </div>
-<div id="sec-normative-references">
-<section id="section-5">
-      <h2 id="name-normative-references">
-<a href="#section-5" class="section-number selfRef">5. </a><a href="#name-normative-references" class="section-name selfRef">Normative References</a>
+<div id="sec-combined-references">
+<section id="section-9">
+      <h2 id="name-references">
+<a href="#section-9" class="section-number selfRef">9. </a><a href="#name-references" class="section-name selfRef">References</a>
       </h2>
+<div id="sec-normative-references">
+<section id="section-9.1">
+        <h3 id="name-normative-references">
+<a href="#section-9.1" class="section-number selfRef">9.1. </a><a href="#name-normative-references" class="section-name selfRef">Normative References</a>
+        </h3>
 <dl class="references">
+<dt id="FIPS203">[FIPS203]</dt>
+        <dd>
+<span class="refTitle">"Module-Lattice-Based Key-Encapsulation Mechanism Standard"</span>, <span class="refContent">National Institute of Standards and Technology</span>, <span class="seriesInfo">DOI 10.6028/nist.fips.203</span>, <time datetime="2024-08" class="refDate">August 2024</time>, <span>&lt;<a href="https://doi.org/10.6028/nist.fips.203">https://doi.org/10.6028/nist.fips.203</a>&gt;</span>. </dd>
+<dd class="break"></dd>
 <dt id="RFC2119">[RFC2119]</dt>
-      <dd>
+        <dd>
 <span class="refAuthor">Bradner, S.</span>, <span class="refTitle">"Key words for use in RFCs to Indicate Requirement Levels"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 2119</span>, <span class="seriesInfo">DOI 10.17487/RFC2119</span>, <time datetime="1997-03" class="refDate">March 1997</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc2119">https://www.rfc-editor.org/rfc/rfc2119</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 <dt id="RFC8174">[RFC8174]</dt>
-    <dd>
+      <dd>
 <span class="refAuthor">Leiba, B.</span>, <span class="refTitle">"Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 8174</span>, <span class="seriesInfo">DOI 10.17487/RFC8174</span>, <time datetime="2017-05" class="refDate">May 2017</time>, <span>&lt;<a href="https://www.rfc-editor.org/rfc/rfc8174">https://www.rfc-editor.org/rfc/rfc8174</a>&gt;</span>. </dd>
 <dd class="break"></dd>
 </dl>
 </section>
 </div>
+<div id="sec-informative-references">
+<section id="section-9.2">
+        <h3 id="name-informative-references">
+<a href="#section-9.2" class="section-number selfRef">9.2. </a><a href="#name-informative-references" class="section-name selfRef">Informative References</a>
+        </h3>
+<dl class="references">
+<dt id="I-D.driscoll-pqt-hybrid-terminology">[I-D.driscoll-pqt-hybrid-terminology]</dt>
+      <dd>
+<span class="refAuthor">D, F.</span>, <span class="refTitle">"Terminology for Post-Quantum Traditional Hybrid Schemes"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-driscoll-pqt-hybrid-terminology-02</span>, <time datetime="2023-03-07" class="refDate">7 March 2023</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-driscoll-pqt-hybrid-terminology-02">https://datatracker.ietf.org/doc/html/draft-driscoll-pqt-hybrid-terminology-02</a>&gt;</span>. </dd>
+<dd class="break"></dd>
+</dl>
+</section>
+</div>
+</section>
+</div>
 <div id="acknowledgments">
 <section id="appendix-A">
       <h2 id="name-acknowledgments">
@@ -1241,8 +1522,8 @@ <h2 id="name-acknowledgments">
 </div>
 <div id="authors-addresses">
 <section id="appendix-B">
-      <h2 id="name-authors-addresses">
-<a href="#name-authors-addresses" class="section-name selfRef">Authors' Addresses</a>
+      <h2 id="name-authors-address">
+<a href="#name-authors-address" class="section-name selfRef">Author's Address</a>
       </h2>
 <address class="vcard">
         <div dir="auto" class="left"><span class="fn nameRole">Deirdre Connolly</span></div>
@@ -1252,22 +1533,6 @@ <h2 id="name-authors-addresses">
 <a href="mailto:durumcrustulum@gmail.com" class="email">durumcrustulum@gmail.com</a>
 </div>
 </address>
-<address class="vcard">
-        <div dir="auto" class="left"><span class="fn nameRole">Bas Westerbaan</span></div>
-<div dir="auto" class="left"><span class="org">Cloudflare</span></div>
-<div class="email">
-<span>Email:</span>
-<a href="mailto:bas@cloudflare.com" class="email">bas@cloudflare.com</a>
-</div>
-</address>
-<address class="vcard">
-        <div dir="auto" class="left"><span class="fn nameRole">Britta Hale</span></div>
-<div dir="auto" class="left"><span class="org">Naval Postgraduate School</span></div>
-<div class="email">
-<span>Email:</span>
-<a href="mailto:britta.hale@nps.edu" class="email">britta.hale@nps.edu</a>
-</div>
-</address>
 </section>
 </div>
 <script>const toc = document.getElementById("toc");
diff --git a/draft-irtf-cfrg-generic-hybrid-kems.txt b/draft-irtf-cfrg-generic-hybrid-kems.txt
new file mode 100644
index 0000000..e36d584
--- /dev/null
+++ b/draft-irtf-cfrg-generic-hybrid-kems.txt
@@ -0,0 +1,283 @@
+
+
+
+
+Crypto Forum                                                 D. Connolly
+Internet-Draft                                                 SandboxAQ
+Intended status: Informational                           22 October 2024
+Expires: 25 April 2025
+
+
+            Generic Hybrid PQ/T Key Encapsulation Mechanisms
+               draft-irtf-cfrg-generic-hybrid-kems-latest
+
+Abstract
+
+   This document defines generic techniques to achive hybrid PQ-T key
+   encapsulation mechanisms (KEMs) from post-quantum and traditional
+   component algorithms that meet specified security properties.
+   Concrete instatiations of techniques are located in another document.
+
+Discussion Venues
+
+   This note is to be removed before publishing as an RFC.
+
+   Discussion of this document takes place on the Crypto Forum Research
+   Group mailing list (cfrg@ietf.org), which is archived at
+   https://mailarchive.ietf.org/arch/browse/cfrg.
+
+   Source for this draft and an issue tracker can be found at
+   https://github.com/cfrg/draft-irtf-cfrg-pq1.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at https://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on 25 April 2025.
+
+Copyright Notice
+
+   Copyright (c) 2024 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents (https://trustee.ietf.org/
+   license-info) in effect on the date of publication of this document.
+   Please review these documents carefully, as they describe your rights
+   and restrictions with respect to this document.
+
+Table of Contents
+
+   1.  Introduction
+     1.1.  Motivation
+     1.2.  Design goals
+       1.2.1.  Non-iteractive
+       1.2.2.  Not authenticated
+     1.3.  Design Non-Goals
+   2.  Conventions and Definitions
+   3.  Conventions and Definitions
+   4.  Hybrid KEM Security Properties
+     4.1.  IND-CCA security
+     4.2.  LEAK-BIND-K-PK security
+     4.3.  LEAK-BIND-K-CT security
+   5.  Hybrid KEM Construction Techniques
+     5.1.  KDF as a secure PRF
+     5.2.  IND-CCA-secure PQ KEM
+     5.3.  'Kitchen Sink' construction:
+     5.4.  'X-Wing' construction
+   6.  Hybrid KEM Instatiations
+   7.  Security Considerations
+   8.  IANA Considerations
+   9.  References
+     9.1.  Normative References
+     9.2.  Informative References
+   Acknowledgments
+   Author's Address
+
+1.  Introduction
+
+1.1.  Motivation
+
+   There are many choices that can be made when specifying a hybrid KEM:
+   the constituent KEMs; their security levels; the combiner; and the
+   hash within, to name but a few.  Having too many similar options are
+   a burden to the ecosystem.
+
+   The aim of this document is provide a small set of techniques for
+   constructing hybrid KEMs designed to achieve specific security
+   properties given conforming component algorithms, that should be
+   suitable for the vast majority of use cases.
+
+1.2.  Design goals
+
+   *  Identify which KEM security properties are IETF-relevant, and
+      provide a terse overview of those security properties (eg.  IND-
+      CCA, LEAK-BIND-K-PK, HON-BIND-K-CT, etc), as well as security
+      properties unique to hybrid KEMs (component key material reuse
+      between hybrid and non-hybrid uses or between multiple hybrids,
+      one component is malicious while the other is honest, etc) with
+      reference to literature, and put into context with real-world
+      attacks.  From that, give guidance on a sensible baseline.
+
+   *  Provide a terse overview of well-reviewed techniques that are
+      options to safely produce the concrete combinations in (C), and
+      which security properties are achieved given those of the
+      constituents.
+
+   *  Provide an initial number of explicit PQ/T hybrid KEMs using
+      techniques from (B) that reach the baseline set in (A), in a
+      separate document, and should include:
+
+       (I)  a hybrid of P-256 and ML-KEM-768,
+       (II)  a hybrid of X25519 and ML-KEM-768, and,
+       (III) a hybrid of P-384 and ML-KEM-1024.
+
+   These hybrids should be accompanied by pseudocode and test vectors.
+
+   This list includes two options at the ~128-bit security level (due to
+   current implementation/deployment trends) and one at a higher level.
+
+1.2.1.  Non-iteractive
+
+   These KEMs are a non-interactive means to establish a shared secret.
+   Using KEMs in place of Diffie-Hellman key exchange can be done in
+   some settings but not all.
+
+1.2.2.  Not authenticated
+
+   These KEMs are not _authenticated_.
+
+1.3.  Design Non-Goals
+
+   There is demand for other hybrid variants that either use different
+   primitives (RSA, NTRU, Classic McEliece, FrodoKEM), parameters, or
+   that use a combiner optimized for a specific use case.  Other use
+   cases could be covered in subsequent documents and not included here.
+
+2.  Conventions and Definitions
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
+   "OPTIONAL" in this document are to be interpreted as described in
+   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
+   capitals, as shown here.
+
+3.  Conventions and Definitions
+
+   This document is consistent with all terminology defined in
+   [I-D.driscoll-pqt-hybrid-terminology].
+
+   The following terms are used throughout this document to describe the
+   operations, roles, and behaviors of HPKE:
+
+   *  concat(x0, ..., xN): returns the concatenation of byte strings.
+      concat(0x01, 0x0203, 0x040506) = 0x010203040506.
+
+   *  random(n): return a pseudorandom byte string of length n bytes
+      produced by a cryptographically-secure random number generator.
+
+4.  Hybrid KEM Security Properties
+
+   Hybrid KEM constructions ideally provide at least:
+
+4.1.  IND-CCA security
+
+   Also known as IND-CCA1 security for general public key encryption,
+   for KEMs that encapsulate a new random 'message' each time,
+
+4.2.  LEAK-BIND-K-PK security
+
+4.3.  LEAK-BIND-K-CT security
+
+   The shared secret
+
+5.  Hybrid KEM Construction Techniques
+
+   Requirements:
+
+5.1.  KDF as a secure PRF
+
+5.2.  IND-CCA-secure PQ KEM
+
+5.3.  'Kitchen Sink' construction:
+
+   Ingredients:
+
+   *  KDF F
+
+   *  label
+
+   *  PQ-CT
+
+   *  PQ-PK
+
+   *  PQ-SS
+
+   *  T-PK
+
+   *  T-CT
+
+   *  T-SS
+
+   def SharedSecret():
+       return F(concat(PQ_SS, T_SS, PQ_CT, PQ_PK, T_CT, T_PK, label))
+
+   Label varies per combos such that the label will vary as the lengths
+   and other properties of the component algorithms vary.  Otherwise
+   we'd have to hash the inputs to fixed lengths or encode lengths into
+   the input.
+
+5.4.  'X-Wing' construction
+
+   Inspired by [XWING] which leverages the security properties of a KEM
+   like ML-KEM to elide other public data from the KDF input.
+
+   def SharedSecret():
+       return F(concat(label, T_SS, PQ_SS, T_CT, T_PK))
+
+   Relies on PQ KEM having LEAK-BIND-K-CT and LEAK-BIND-K-PK security,
+   which is related to the collision-freeness of the underlying PKE
+   scheme of a FO-transform KEM like ML-KEM.
+
+6.  Hybrid KEM Instatiations
+
+   See the other document.
+
+7.  Security Considerations
+
+   IND-CCA, LEAK-BIND-K-PK, etc, as well as security properties unique
+   to hybrid KEMs (component key material reuse between hybrid and non-
+   hybrid uses or between multiple hybrids, one component is malicious
+   while the other is honest, etc)
+
+8.  IANA Considerations
+
+   This document has no IANA actions.
+
+9.  References
+
+9.1.  Normative References
+
+   [FIPS203]  "Module-Lattice-Based Key-Encapsulation Mechanism
+              Standard", National Institute of Standards and Technology,
+              DOI 10.6028/nist.fips.203, August 2024,
+              <https://doi.org/10.6028/nist.fips.203>.
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119,
+              DOI 10.17487/RFC2119, March 1997,
+              <https://www.rfc-editor.org/rfc/rfc2119>.
+
+   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
+              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
+              May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
+
+9.2.  Informative References
+
+   [I-D.driscoll-pqt-hybrid-terminology]
+              D, F., "Terminology for Post-Quantum Traditional Hybrid
+              Schemes", Work in Progress, Internet-Draft, draft-
+              driscoll-pqt-hybrid-terminology-02, 7 March 2023,
+              <https://datatracker.ietf.org/doc/html/draft-driscoll-pqt-
+              hybrid-terminology-02>.
+
+Acknowledgments
+
+   TODO acknowledge.
+
+Author's Address
+
+   Deirdre Connolly
+   SandboxAQ
+   Email: durumcrustulum@gmail.com
diff --git a/draft-irtf-cfrg-hybrid-kems.txt b/draft-irtf-cfrg-hybrid-kems.txt
deleted file mode 100644
index 90e21e7..0000000
--- a/draft-irtf-cfrg-hybrid-kems.txt
+++ /dev/null
@@ -1,155 +0,0 @@
-
-
-
-
-Crypto Forum                                                 D. Connolly
-Internet-Draft                                                 SandboxAQ
-Intended status: Informational                          B. E. Westerbaan
-Expires: 18 March 2025                                        Cloudflare
-                                                                 B. Hale
-                                               Naval Postgraduate School
-                                                       14 September 2024
-
-
-                Hybrid PQ/T Key Encapsulation Mechanisms
-                   draft-irtf-cfrg-hybrid-kems-latest
-
-Abstract
-
-   TODO Abstract
-
-Discussion Venues
-
-   This note is to be removed before publishing as an RFC.
-
-   Discussion of this document takes place on the Crypto Forum Research
-   Group mailing list (cfrg@ietf.org), which is archived at
-   https://mailarchive.ietf.org/arch/browse/cfrg.
-
-   Source for this draft and an issue tracker can be found at
-   https://github.com/cfrg/draft-irtf-cfrg-pq1.
-
-Status of This Memo
-
-   This Internet-Draft is submitted in full conformance with the
-   provisions of BCP 78 and BCP 79.
-
-   Internet-Drafts are working documents of the Internet Engineering
-   Task Force (IETF).  Note that other groups may also distribute
-   working documents as Internet-Drafts.  The list of current Internet-
-   Drafts is at https://datatracker.ietf.org/drafts/current/.
-
-   Internet-Drafts are draft documents valid for a maximum of six months
-   and may be updated, replaced, or obsoleted by other documents at any
-   time.  It is inappropriate to use Internet-Drafts as reference
-   material or to cite them other than as "work in progress."
-
-   This Internet-Draft will expire on 18 March 2025.
-
-Copyright Notice
-
-   Copyright (c) 2024 IETF Trust and the persons identified as the
-   document authors.  All rights reserved.
-
-   This document is subject to BCP 78 and the IETF Trust's Legal
-   Provisions Relating to IETF Documents (https://trustee.ietf.org/
-   license-info) in effect on the date of publication of this document.
-   Please review these documents carefully, as they describe your rights
-   and restrictions with respect to this document.
-
-Table of Contents
-
-   1.  Introduction
-   2.  Conventions and Definitions
-   3.  Security Considerations
-   4.  IANA Considerations
-   5.  Normative References
-   Acknowledgments
-   Authors' Addresses
-
-1.  Introduction
-
-   We propose "Hybrid PQ/T Key Encapsulation Mechanisms", which will
-   cover the following.
-
-   (A) Identify which KEM security properties are IETF-relevant, and
-   provide a terse overview of those security properties (eg.  IND-CCA,
-   LEAK-BIND-K-PK, HON-BIND-K-CT, etc), as well as security properties
-   unique to hybrid KEMs (component key material reuse between hybrid
-   and non-hybrid uses or between multiple hybrids, one component is
-   malicious while the other is honest, etc) with reference to
-   literature, and put into context with real-world attacks.  From that,
-   give guidance on a sensible baseline.
-
-   (B) Provide a terse overview of well-reviewed techniques that are
-   options to safely produce the concrete combinations in (C), and which
-   security properties are achieved given those of the constituents.
-
-   (C) Provide an initial number of explicit PQ/T hybrid KEMs using
-   techniques from (B) that reach the baseline set in (A), in a separate
-   document, and should include:
-
-      (I)  a hybrid of P-256 and ML-KEM-768,
-      (II)  a hybrid of X25519 and ML-KEM-768, and,
-      (III) a hybrid of P-384 and ML-KEM-1024.
-
-   These hybrids should be accompanied by pseudocode and test vectors.
-
-   This list includes two options at the ~128-bit security level (due to
-   current implementation/deployment trends) and one at a higher level.
-
-   There is demand for other hybrid variants that either use different
-   primitives (RSA, NTRU, Classic McEliece, FrodoKEM), parameters, or
-   that use a combiner optimized for a specific use case.  The DT
-   recommends the work outlined in (C) is done in a first document, and
-   other use cases could be covered in subsequent documents.
-
-2.  Conventions and Definitions
-
-   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
-   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
-   "OPTIONAL" in this document are to be interpreted as described in
-   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
-   capitals, as shown here.
-
-3.  Security Considerations
-
-   IND-CCA, LEAK-BIND-K-PK, etc, as well as security properties unique
-   to hybrid KEMs (component key material reuse between hybrid and non-
-   hybrid uses or between multiple hybrids, one component is malicious
-   while the other is honest, etc)
-
-4.  IANA Considerations
-
-   This document has no IANA actions.
-
-5.  Normative References
-
-   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
-              Requirement Levels", BCP 14, RFC 2119,
-              DOI 10.17487/RFC2119, March 1997,
-              <https://www.rfc-editor.org/rfc/rfc2119>.
-
-   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
-              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
-              May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
-
-Acknowledgments
-
-   TODO acknowledge.
-
-Authors' Addresses
-
-   Deirdre Connolly
-   SandboxAQ
-   Email: durumcrustulum@gmail.com
-
-
-   Bas Westerbaan
-   Cloudflare
-   Email: bas@cloudflare.com
-
-
-   Britta Hale
-   Naval Postgraduate School
-   Email: britta.hale@nps.edu
diff --git a/index.html b/index.html
index 4b830a4..f83a426 100644
--- a/index.html
+++ b/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>cfrg/draft-irtf-cfrg-hybrid-kems main preview</title>
+    <title>cfrg/draft-irtf-cfrg-generic-hybrid-kems main preview</title>
     <meta name="viewport" content="initial-scale=1.0">
     <style type="text/css">/*<![CDATA[*/
       body { font-family: "Helvetica Neue","Open Sans", Helvetica, Calibri,sans-serif; }
@@ -13,14 +13,14 @@
     /*]]>*/</style>
   </head>
   <body>
-    <h1>Editor's drafts for main branch of <a href="https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems">cfrg/draft-irtf-cfrg-hybrid-kems</a></h1>
-    <p>View <a href="issues.html">saved issues</a>, or the latest GitHub <a href="https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems/issues">issues</a> and <a href="https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems/pulls">pull requests</a> in the <a href="https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems">repo</a>.</p>
+    <h1>Editor's drafts for main branch of <a href="https://github.com/cfrg/draft-irtf-cfrg-generic-hybrid-kems">cfrg/draft-irtf-cfrg-generic-hybrid-kems</a></h1>
+    <p>View <a href="issues.html">saved issues</a>, or the latest GitHub <a href="https://github.com/cfrg/draft-irtf-cfrg-generic-hybrid-kems/issues">issues</a> and <a href="https://github.com/cfrg/draft-irtf-cfrg-generic-hybrid-kems/pulls">pull requests</a> in the <a href="https://github.com/cfrg/draft-irtf-cfrg-generic-hybrid-kems">repo</a>.</p>
     <table id="branch-main">
       <tr>
-        <td><a href="./draft-irtf-cfrg-hybrid-kems.html" class="html draft-irtf-cfrg-hybrid-kems" title="Hybrid PQ/T Key Encapsulation Mechanisms (HTML)">hybrid-kems</a></td>
-        <td><a href="./draft-irtf-cfrg-hybrid-kems.txt" class="txt draft-irtf-cfrg-hybrid-kems" title="Hybrid PQ/T Key Encapsulation Mechanisms (Text)">plain text</a></td>
-        <td><a href="https://datatracker.ietf.org/doc/draft-irtf-cfrg-hybrid-kems" class="dt draft-irtf-cfrg-hybrid-kems" title="Datatracker for draft-irtf-cfrg-hybrid-kems">datatracker</a></td>
-        <td><a href="https://author-tools.ietf.org/api/iddiff?doc_1=draft-irtf-cfrg-hybrid-kems&amp;url_2=https://cfrg.github.io/draft-irtf-cfrg-hybrid-kems/draft-irtf-cfrg-hybrid-kems.txt" class="diff draft-irtf-cfrg-hybrid-kems">diff with last submission</a></td>
+        <td><a href="./draft-irtf-cfrg-generic-hybrid-kems.html" class="html draft-irtf-cfrg-generic-hybrid-kems" title="Generic Hybrid PQ/T Key Encapsulation Mechanisms (HTML)">generic-hybrid-kems</a></td>
+        <td><a href="./draft-irtf-cfrg-generic-hybrid-kems.txt" class="txt draft-irtf-cfrg-generic-hybrid-kems" title="Generic Hybrid PQ/T Key Encapsulation Mechanisms (Text)">plain text</a></td>
+        <td><a href="https://datatracker.ietf.org/doc/draft-irtf-cfrg-generic-hybrid-kems" class="dt draft-irtf-cfrg-generic-hybrid-kems" title="Datatracker for draft-irtf-cfrg-generic-hybrid-kems">datatracker</a></td>
+        <td><a href="https://author-tools.ietf.org/api/iddiff?doc_1=draft-irtf-cfrg-generic-hybrid-kems&amp;url_2=https://cfrg.github.io/draft-irtf-cfrg-generic-hybrid-kems/draft-irtf-cfrg-generic-hybrid-kems.txt" class="diff draft-irtf-cfrg-generic-hybrid-kems">diff with last submission</a></td>
         <td></td>
       </tr>
     </table>