X-Wing — IETF KEM Combiner
IETF X-Wing hybrid KEM combiner — X25519 ⨁ ML-KEM-768 with SHA3-256 / cSHAKE128 key derivation. RFC draft-connolly-cfrg-xwing-kem (CFRG).
Implementation status (code-audited 2026-07-03): DESIGN — NOT YET IMPLEMENTED (as specified) Shipped crypto/encryption/xwing.go wraps luxfi/age HybridRecipient (HPKE-based MLKEM768-X25519 hybrid) — NOT the IETF draft-connolly XOR-then-PRF combiner with DST
\.//this LP specifies; luxfi/crypto/kem/xwing does not exist.
Abstract
X-Wing is the IETF hybrid KEM combiner defined in
draft-connolly-cfrg-xwing-kem, combining X25519 (classical
elliptic-curve Diffie-Hellman) with ML-KEM-768 (NIST FIPS 203
lattice KEM, LP-4318) using a SHA3-256 / cSHAKE128 key derivation
function with explicit domain separation. The combined shared
secret is secure as long as at least one component (X25519 or
ML-KEM-768) remains unbroken — a "hedge" against unknown
cryptanalysis of either family. X-Wing is the Lux default KEM
combiner for transitional PQ-hybrid TLS sessions and for any
session-key context that must remain usable across the
classical-to-PQ transition. The KEM-combiner construction follows
the "XOR-then-PRF" pattern from the IETF draft with the canonical
DST tag \.//. Sizes: combined public key 1,216 B (32 X25519 +
1,184 ML-KEM-768), combined ciphertext 1,120 B (32 X25519 + 1,088
ML-KEM-768), shared secret 32 B. For the family-disjoint extension
with HQC see LP-4930 (X-Wing+).
Reference implementation
- Primitive:
luxfi/crypto/kem/xwing(planned) - Upstream: draft-connolly-cfrg-xwing-kem (IETF CFRG)
- Components: LP-4318 (ML-KEM), X25519 (classical curve, no Lux LP)
Copyright
Copyright and related rights waived via CC0.