{
  "all_omit_recipient_pk_from_kdf": true,
  "evidence": [
    {
      "citation": "RFC 9980 \u00a74.2.1 (combiner) + \u00a74.3.2.2 (key format)",
      "confirmed": "INDEPENDENTLY CONFIRMED by fetching RFC 9980 text (2026-07-15)",
      "ct_in_kdf": false,
      "kdf_context_verbatim": "KEK = SHA3-256( mlkemKeyShare || ecdhKeyShare || ecdhCipherText || ecdhPublicKey || algId || domSep || len(domSep) )",
      "key_format_verbatim": "\u00a74.3.2.2: \"the secret key is given by the concatenation of the values of d and z, generated in steps 1 and 2 of ML-KEM.KeyGen [FIPS-203], each of a length of 32 octets.\" (a 64-octet d||z seed -> z is attacker-settable)",
      "observation": "the combiner binds the ECDH public key and ciphertext but OMITS mlkemPublicKey and mlkemCipherText; the ML-KEM secret is the raw 64-octet d||z seed.",
      "pk_in_kdf": false,
      "standard": "OpenPGP PQC",
      "status": "PUBLISHED RFC",
      "url": "https://www.rfc-editor.org/rfc/rfc9980.txt"
    },
    {
      "citation": "RFC 9629 \u00a73 (KEMRecipientInfo) + \u00a75 (KDF info)",
      "confirmed": "INDEPENDENTLY CONFIRMED by fetching RFC 9629 text (2026-07-15)",
      "ct_in_kdf": false,
      "kdf_context_verbatim": "CMSORIforKEMOtherInfo ::= SEQUENCE { wrap KeyEncryptionAlgorithmIdentifier, kekLength INTEGER (1..65535), ukm [0] EXPLICIT UserKeyingMaterial OPTIONAL }",
      "key_format_verbatim": "KEMRecipientInfo carries `kemct OCTET STRING` and `rid RecipientIdentifier` as SEPARATE fields \u2014 neither the ciphertext nor the recipient public key enters the KDF info (CMSORIforKEMOtherInfo).",
      "observation": "the KDF info is only {wrap, kekLength, ukm?}; it OMITS the recipient public key and the KEM ciphertext (kemct is a sibling field, outside the info). Reused by PKCS#11 v3.2 + S/MIME + draft-ietf-lamps-cms-kyber.",
      "pk_in_kdf": false,
      "standard": "CMS KEMRecipientInfo",
      "status": "PUBLISHED RFC (Proposed Standard)",
      "url": "https://www.rfc-editor.org/rfc/rfc9629.txt"
    },
    {
      "citation": "draft-ietf-lamps-pq-composite-kem (KemCombiner)",
      "confirmed": "from exact-spec scout of draft-17; VERIFY against the cited draft version",
      "ct_in_kdf": false,
      "kdf_context_verbatim": "ss = SHA3-256( mlkemSS || tradSS || tradCT || tradPK || Label )",
      "key_format_verbatim": "draft \u00a7ML-KEM key: mlkemSeed = d || z (independent 64-octet seed) -> z attacker-settable. Draft line ~1826 concedes X-Wing's joint-seed KeyGen has 'some additional binding properties' the mandatory construction lacks.",
      "observation": "the combiner binds the traditional ss/ct/pk but OMITS mlkemPK and mlkemCT; raw d||z seed. (Already covered by the published class result ePrint 2025/1416 \u2014 not novel here.)",
      "pk_in_kdf": false,
      "standard": "LAMPS Composite ML-KEM",
      "status": "Internet-Draft",
      "url": "https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-kem/"
    },
    {
      "citation": "draft-ietf-jose-pqc-kem-05 \u00a75 (KDF context)",
      "confirmed": "from exact-spec scout of -05; VERIFY against the cited draft version",
      "ct_in_kdf": false,
      "kdf_context_verbatim": "K = SS' (the KEM shared secret); X (context) = AlgorithmID || SuppPubInfo || SuppPrivInfo. Verbatim rationale: \"PartyUInfo is omitted because post-quantum KEMs do not support sender authentication. PartyVInfo is excluded because the recipient's identity is already bound to the public key used for encapsulation, making its inclusion unnecessary.\"",
      "key_format_verbatim": "ciphertext conveyed out-of-band in the `ek` header, NOT in the KDF (\"The parameter 'ek' MUST include the output ('ct') from the PQ-KEM algorithm\").",
      "observation": "KMAC/SP800-108 KDF context excludes PartyUInfo AND PartyVInfo -> OMITS the recipient public key; ciphertext is in the `ek` header, not the KDF. The draft's own rationale asserts the exact property a MAL-BIND-K-PK adversary defeats. (WG draft -05 removed the ciphertext-in-KDF that the older individual draft-reddy had \u2014 model against -05.)",
      "pk_in_kdf": false,
      "standard": "JOSE/COSE PQ-KEM",
      "status": "Internet-Draft",
      "url": "https://datatracker.ietf.org/doc/html/draft-ietf-jose-pqc-kem-05"
    }
  ],
  "honest_note": "This is the CHECKABLE core: an external reviewer verifies each quote against the primary source (2 published RFCs independently confirmed here; 2 drafts to verify against the cited version). The primitive fact (ML-KEM not MAL-BIND-K-PK) + the class ceiling are CITED (Schmieg 2024/523; CDM 2023/1933; ePrint 2025/1416). No exploit is claimed; exploitability is deployment-dependent and unestablished.",
  "module": "pqc_keytransport_spec_evidence",
  "n_independently_confirmed": 2,
  "n_standards": 4,
  "purpose": "verbatim normative-text evidence that four standards omit the recipient ML-KEM public key from their KEK/CEK KDF context \u2014 the genuinely-new, checkable contribution of the class result.",
  "sprint": 140,
  "status": "evidence/documentation artifact; RED findings remain human+counsel, never auto-promoted. No legal/novelty/FTO/essentiality/price conclusion."
}