draft-thomson-ppm-prss-00 6.1: Could PRFs other than AES ever be supported?

[tgeoghegan]

The document is generic over abstract descriptions of KEMs and KDFs, but then concretely requires either AES128 or 256 for the PRF. Section 6.1 cites GKWY20, which only considers AES. If someone did security proofs etc., could this method be extended to hashes (TurboSHAKE as in VDAF) or other symmetric ciphers?

[martinthomson]

The use of an XOF would be very interesting here. The shape changes quite a bit, of course.

My view is that we'd want to see whether an XOF variant is faster. If it is faster always, then we'd stop using AES. If it is faster sometimes, that might make a case for two options, but we'd need to discuss what the costs look like.