Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Lecture notes in computer science

Saber: Module-LWR Based Key Exchange, CPA-Secure Encryption and CCA-Secure KEM

Jan-Pieter D’Anvers, Angshuman Karmakar, Sujoy Sinha Roy, Fréderik Vercauteren

Published Jan 1, 2018• 276 citations
Publisher
DOI
10.1007/978-3-319-89339-6_16

Related papers

2-Pass Key Exchange Protocols from CPA-Secure KEM

Kaoru Kurosawa, Jun Furukawa

Lecture notes in computer science•Jan 1, 2014•11 citations

Compact Authenticated Key Exchange from Bounded CCA-Secure KEM

Kazuki Yoneyama

Lecture notes in computer science•Jan 1, 2013•4 citations

CCA-Secure (Puncturable) KEMs from Encryption with Non-Negligible Decryption Errors

Valerio Cini, Sebastian Ramacher, Daniel Slamanig +1 more

Lecture notes in computer science•Jan 1, 2020•13 citations

CRYSTALS - Kyber: A CCA-Secure Module-Lattice-Based KEM

Joppe W. Bos, Léo Ducas, Eike Kiltz +6 more

Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digitalsignature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes. This paper introduces Kyber (part of CRYSTALS - Cryptographic Suite for Algebraic Lattices - a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NEWHOPE KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme. We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki-Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than 128 bits of postquantum security.

IEEE European Symposium on Security and Privacy•Apr 1, 2018•1,196 citations

On the Security and Efficiency of TLS 1.3 Handshake with Hybrid Key Exchange from CPA-Secure KEMs

Jinrong Chen, Wei Peng, Yi Wang +1 more

TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.

Entropy•Dec 8, 2025•6 citations

MoRo: From One-Sample Ring-LWE Rounding Key Exchange to Module-LWE IND-CCA KEM

Yuntao Wang, Yuki Otsuka, Tsuyoshi Takagi

With the growing need for long-term secure communications in Internet-of-Things (IoT) and sensor-network environments, practical and robust post-quantum key-establishment mechanisms have become increasingly important. In this work, we revisit the ephemeral-only Ding key exchange (DKE) proposed at ACNS 2019, which is based on one-sample Ring Learning With Errors (Ring-LWE) with rounding, and the original analysis of which covers only passive security. Building on the DKE framework, we propose MoRo-KEM, a Module Learning With Errors (Module-LWE)-based key-encapsulation mechanism using rounding. First, we lift the construction from the Ring-LWE setting to the Module-LWE setting, retaining ring-level efficiency while enabling more flexible parameter choices and reducing reliance on rigid algebraic structure. Second, we replace discrete Gaussian sampling for secrets and errors with centered binomial sampling, thereby simplifying constant-time vectorized implementations while preserving the required noise behavior. Third, we extend the resulting key-exchange core to an IND-CPA-secure public-key encryption scheme and further obtain an IND-CCA-secure KEM via the Fujisaki-Okamoto transform. Finally, at security level I, MoRo-KEM achieves a decryption failure rate of 2-166, lower than the 2-139 reported for CRYSTALS-Kyber, thus improving robustness against decryption-failure attacks. These properties make the proposed design attractive for secure key establishment among sensor nodes, edge devices, and gateways operating under constrained computation, memory, and communication budgets. Overall, our construction provides a concrete path from ephemeral key exchange to a practical IND-CCA-secure KEM instantiated over Module-LWE.

Sensors•Jun 9, 2026•0 citations
Rapid advances in quantum computing, together with the announcement by the National Institute of Standards and Technology (NIST) to define new standards for digitalsignature, encryption, and key-establishment protocols, have created significant interest in post-quantum cryptographic schemes. This paper introduces Kyber (part of CRYSTALS - Cryptographic Suite for Algebraic Lattices - a package submitted to NIST post-quantum standardization effort in November 2017), a portfolio of post-quantum cryptographic primitives built around a key-encapsulation mechanism (KEM), based on hardness assumptions over module lattices. Our KEM is most naturally seen as a successor to the NEWHOPE KEM (Usenix 2016). In particular, the key and ciphertext sizes of our new construction are about half the size, the KEM offers CCA instead of only passive security, the security is based on a more general (and flexible) lattice problem, and our optimized implementation results in essentially the same running time as the aforementioned scheme. We first introduce a CPA-secure public-key encryption scheme, apply a variant of the Fujisaki-Okamoto transform to create a CCA-secure KEM, and eventually construct, in a black-box manner, CCA-secure encryption, key exchange, and authenticated-key-exchange schemes. The security of our primitives is based on the hardness of Module-LWE in the classical and quantum random oracle models, and our concrete parameters conservatively target more than 128 bits of postquantum security.
TLS 1.3 is a crucial protocol for securing modern internet communications. To facilitate a smooth transition to post-quantum security, hybrid key exchange, which combines classical key exchange algorithms with post-quantum key encapsulation mechanisms (KEMs), is proposed to enhance the security of the current TLS 1.3 handshake. However, existing drafts and implementations of hybrid key exchange for TLS 1.3 primarily rely on CCA-secure KEMs (i.e., secure against chosen-ciphertext attacks) based on the Fujisaki-Okamoto (FO) transform. The re-encryption step in their decapsulation algorithms not only introduces additional performance overhead but also raises the risk of side-channel attacks. Although Huguenin-Dumittan and Vaudenay (Eurocrypt 2022) and Zhou et al. (Asiacrypt 2024) demonstrated that the weaker CPA-secure KEMs (i.e., secure against chosen-plaintext attacks) suffice for constructing a secure TLS 1.3 handshake, their analyses were limited to single-KEM settings and did not consider the hybrid key exchange scenario. This work challenges the necessity of CCA security by proving that CPA-secure KEMs are sufficient for the TLS 1.3 handshake even in the hybrid key exchange setting. We provide the first formal security proofs for this claim, covering both the classical random oracle model (ROM) and the quantum random oracle model (QROM), thereby ensuring security against quantum adversaries. To validate the practical benefits, we conduct an extensive performance evaluation based on the latest OpenSSL implementation. Our results show that using CPA-secure KEMs yields up to 44.8% performance improvement at the key exchange layer and up to approximately 9% acceleration for the full TLS 1.3 handshake. Beyond performance gains, this approach reduces the codebase's attack surface by eliminating the re-encryption step, thereby mitigating a class of side-channel vulnerabilities. Our work positions CPA-secure KEMs as a secure, efficient, and practical alternative for standardizing and deploying post-quantum TLS 1.3 even with hybrid key exchange.
With the growing need for long-term secure communications in Internet-of-Things (IoT) and sensor-network environments, practical and robust post-quantum key-establishment mechanisms have become increasingly important. In this work, we revisit the ephemeral-only Ding key exchange (DKE) proposed at ACNS 2019, which is based on one-sample Ring Learning With Errors (Ring-LWE) with rounding, and the original analysis of which covers only passive security. Building on the DKE framework, we propose MoRo-KEM, a Module Learning With Errors (Module-LWE)-based key-encapsulation mechanism using rounding. First, we lift the construction from the Ring-LWE setting to the Module-LWE setting, retaining ring-level efficiency while enabling more flexible parameter choices and reducing reliance on rigid algebraic structure. Second, we replace discrete Gaussian sampling for secrets and errors with centered binomial sampling, thereby simplifying constant-time vectorized implementations while preserving the required noise behavior. Third, we extend the resulting key-exchange core to an IND-CPA-secure public-key encryption scheme and further obtain an IND-CCA-secure KEM via the Fujisaki-Okamoto transform. Finally, at security level I, MoRo-KEM achieves a decryption failure rate of 2-166, lower than the 2-139 reported for CRYSTALS-Kyber, thus improving robustness against decryption-failure attacks. These properties make the proposed design attractive for secure key establishment among sensor nodes, edge devices, and gateways operating under constrained computation, memory, and communication budgets. Overall, our construction provides a concrete path from ephemeral key exchange to a practical IND-CCA-secure KEM instantiated over Module-LWE.