util

func PairSplitPRF ¶

func PairSplitPRF(ss1, ss2, cct1, cct2 []byte) []byte

PairSplitPRF is a split PRF that operates on only two KEMs.

func SplitPRF ¶

func SplitPRF(ss, cct [][]byte) []byte

SplitPRF can be used with any number of KEMs and it implement split PRF KEM combiner as:

cct := cct1 || cct2 || cct3 || ...
return H(ss1 || cct) XOR H(ss2 || cct) XOR H(ss3 || cct)

in order to retain IND-CCA2 security as described in KEM Combiners https://eprint.iacr.org/2018/024.pdf by Federico Giacon, Felix Heuer, and Bertram Poettering