Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

A Modular Analysis of the Fujisaki-Okamoto Transformation

Dennis Hofheinz, Kathrin Hövelmanns, Eike Kiltz

Published Jan 1, 2017• 463 citations
Publisher
DOI
10.1007/978-3-319-70500-2_12

Related papers

Implicit Rejection in Fujisaki-Okamoto: Framework and a Novel Realization

Chen Zhao, Xianhui Lu, Dingding Jia +1 more

Lecture notes in computer science•Jan 1, 2022•0 citations

On the Complete Non-malleability of the Fujisaki-Okamoto Transform

Daniele Friolo, Matteo Salvino, Daniele Venturi

Lecture notes in computer science•Jan 1, 2023•0 citations

On the Anonymity of Multi-Receiver Identity-Based Encryption Based on Fujisaki–Okamoto Transformation

Yi‐Fan Tseng, Chun‐I Fan, Cheng-Wei Sung

In 2010, Fan et al. first introduced the concept of anonymous multi-receiver identity-based encryption (AMRIBE). They used the concept of Fujisaki–Okamoto transformation (F.O. transformation) to support their proof in random oracle models. Recently, many works on this topic have been proposed. Most of them adopted Fujisaki–Okamoto transformation to achieve the indistinguishability of encryptions under multi-ID, chosen-ciphertext attacks (IND-MID-CCA) security. However, we find out that these schemes do not gain anonymity against insider attacks. In this manuscript, we use a sequence of games to prove that any AMRIBE scheme will fail to gain anonymity under chosen-ciphertext attacks and chosen-plaintext attacks if the IND-MID-CCA security is proven using Fujisaki–Okamoto transformation.

International Journal of Foundations of Computer Science•Jun 1, 2019•0 citations

Remarks on the Lewenstein–Sanpera decomposition

Mingjun Shi, Jiangfeng Du

arXiv:quant-ph/0012145•Physics Letters A•Jul 1, 2001•1 citation

Binding Security of Implicitly-Rejecting KEMs and Application to BIKE and HQC

Juliane Krämer, Patrick Struck, Maximiliane Weishäupl

In this work, we continue the analysis of the binding properties of implicitly-rejecting key-encapsulation mechanisms (KEMs) obtained via the Fujisaki-Okamoto (FO) transform. These binding properties, in earlier literature known under the term robustness, thwart attacks that can arise when using KEMs in complex protocols. Recently, Cremers et al. (CCS'24) introduced a framework for binding notions, encompassing previously existing but also new ones. While implicitly-rejecting FO-KEMs have been analyzed with respect to multiple of these notions, there are still several gaps. We complete the picture by providing positive and negative results for the remaining notions. Further, we show how to apply our results to the code-based KEMs BIKE and HQC, which were round-4 candidates in NIST's PQC standardization process. Through this, we close a second gap as our results complete the analysis of the binding notions for the NIST round-4 KEMs. Finally, we give a modified version of the FO transform that achieves all binding notions.

IACR Communications in Cryptology•Jul 7, 2025•4 citations

Faster Lattice-Based KEMs via a Generic Fujisaki-Okamoto Transform Using Prefix Hashing

Julien Duman, Kathrin Hövelmanns, Eike Kiltz +2 more

Constructing an efficient CCA-secure KEM is generally done by first constructing a passively-secure PKE scheme, and then applying the Fujisaki-Okamoto (FO) transformation. The original FO transformation was designed to offer security in a single user setting. A stronger notion, known as multi-user security, considers the attacker's advantage in breaking one of many user's ciphertexts. Bellare et al. (EUROCRYPT 2000) showed that standard single user security implies multi-user security with a multiplicative tightness gap equivalent to the number of users.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Nov 12, 2021•33 citations
In 2010, Fan et al. first introduced the concept of anonymous multi-receiver identity-based encryption (AMRIBE). They used the concept of Fujisaki–Okamoto transformation (F.O. transformation) to support their proof in random oracle models. Recently, many works on this topic have been proposed. Most of them adopted Fujisaki–Okamoto transformation to achieve the indistinguishability of encryptions under multi-ID, chosen-ciphertext attacks (IND-MID-CCA) security. However, we find out that these schemes do not gain anonymity against insider attacks. In this manuscript, we use a sequence of games to prove that any AMRIBE scheme will fail to gain anonymity under chosen-ciphertext attacks and chosen-plaintext attacks if the IND-MID-CCA security is proven using Fujisaki–Okamoto transformation.
In this work, we continue the analysis of the binding properties of implicitly-rejecting key-encapsulation mechanisms (KEMs) obtained via the Fujisaki-Okamoto (FO) transform. These binding properties, in earlier literature known under the term robustness, thwart attacks that can arise when using KEMs in complex protocols. Recently, Cremers et al. (CCS'24) introduced a framework for binding notions, encompassing previously existing but also new ones. While implicitly-rejecting FO-KEMs have been analyzed with respect to multiple of these notions, there are still several gaps. We complete the picture by providing positive and negative results for the remaining notions. Further, we show how to apply our results to the code-based KEMs BIKE and HQC, which were round-4 candidates in NIST's PQC standardization process. Through this, we close a second gap as our results complete the analysis of the binding notions for the NIST round-4 KEMs. Finally, we give a modified version of the FO transform that achieves all binding notions.
Constructing an efficient CCA-secure KEM is generally done by first constructing a passively-secure PKE scheme, and then applying the Fujisaki-Okamoto (FO) transformation. The original FO transformation was designed to offer security in a single user setting. A stronger notion, known as multi-user security, considers the attacker's advantage in breaking one of many user's ciphertexts. Bellare et al. (EUROCRYPT 2000) showed that standard single user security implies multi-user security with a multiplicative tightness gap equivalent to the number of users.