gnupg: Use KEM interface for encryption/decryption
Testing, HighPublic
Actions

Assigned To

Authored By

	• gniibe
	May 13 2025, 2:01 AM

Description

T7014: agent: Enhancement of PKDECRYPT for KEM interface introduced use of KEM API (of libgcrypt) to gpg-agent.
It is good (for industrial certification(s) and auditors) to use KEM API in gpg frontend.

rG GnuPG
	rG681d75404300 gpg,agent: Clean up around using ECC KEM.
	rG07e8ca2a9b54 gpg: Use ECC KEM interface for decryption.
	rG04782e7fd629 agent: Add support for TPM2 for ECC KEM.
	rGb956f47e2ab0 agent: Finish ECC KEM, adding support for NIST curves.
	rG57a3d2392539 agent: Support ECC KEM by PKDECRYPT --kem.
	rGeb9c39ac5bb5 agent: Refactor ECC KEM decap operation.
	rGd1c3bfda2a8c gpg: Use the KEM API for ECC encryption.
	rG40cfa71281db common: Add KEM constants for NIST curves.

Status	Assigned	Task
Testing	• gniibe	T7649 gnupg: Use KEM interface for encryption/decryption
Resolved	• werner	T7014 agent: Enhancement of PKDECRYPT for KEM interface
Open	• gniibe	T7097 Support a key on smartcard for PQC
Resolved	• gniibe	T5964 gnupg should use the KDFs implemented in libgcrypt

• gniibe triaged this task as High priority.

• gniibe created this task.

NIST has an initial public draft for KEM: https://csrc.nist.gov/pubs/sp/800/227/ipd

• gniibe renamed this task from gnupg: Use KEM interface for decryption to gnupg: Use KEM interface for encryption/decryption.May 19 2025, 2:35 AM

Pushed all changes needed. Actually, agent side too.
Clean up will be done.

FYI: I'd like to get a new release out after these changes.

Clean up finished by rG681d75404300: gpg,agent: Clean up around using ECC KEM.
Tested by make check and decrypting tests/openpgp/samplemsgs/pqc-sample-*.enc.asc.

@werner I think these changes caused an ASAN failure that I reported in T7664. I think it would be good to get that sorted before a release.

Another possible change will be use of KEM interface for gpgsm.
Not high priority, but for long term code maintenance.