Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

ACM ASIA Public-Key Cryptography Workshop (APKC)

Error Term Checking: Towards Chosen Ciphertext Security without Re-encryption

Jan-Pieter D’Anvers, Emmanuela Orsini, Fréderik Vercauteren

Published May 24, 2021• 3 citations
Publisher

Abstract

Chosen ciphertext security for lattice based encryption schemes is generally achieved through a generic transformation such as the Fujisaki-Okamoto transformation. This method requires full re-encryption of the plaintext during decapsulation, which typically dominates the cost of the latter procedure. In this work we show that it is possible to develop alternative transformations specifically designed for lattice based encryption schemes. We propose two novel chosen ciphertext transformations, ETC1 and ETC2, in which re-encryption is replaced by checking the error term of the input ciphertext. We show that our new ciphertext validity check can be securely applied to lattice based encryption schemes under specific conditions. For the NIST post-quantum standardization candidate Threebears we show a speed-up for decapsulation of up to 37.4%. Moreover, as our method only changes the validation check during decapsulation, it is fully backwards compatible with existing implementations of the Fujisaki-Okamoto transformation.

DOI
10.1145/3457338.3458295

Related papers

Rethinking on Ciphertext Equality Check of Decapsulation of NIST PQC Standardization 3rd Round Finalist Candidate Saber

Donghoon Lee, Eun-Young Seo, Young-Sik Kim +1 more

In this paper, we rethink the ciphertext equality check step of the decapsulation procedure of Saber, which is one out of four KEM finalists in the third round NIST PQC standardization process. Through this investigation, we pursue cryptographic answers to some important questions. Those are why the re-encryption process of Fujisaki-Okamoto transformation, which is commonly used method to satisfy IND-CCA security in most existing lattice-based KEM algorithms including Saber, is especially necessary in the case of Saber, whether the re-encryption process can be further simplified, and whether the ciphertext equality check must be performed over the entire (re-encrypted/originally received) ciphertexts?

International Conference on Information and Communication Technology Convergence (ICTC)•Oct 19, 2022•2 citations

Analysis of the FO Transformation in the Lattice-Based Post-Quantum Algorithms

Miguel Ángel González de la Torre, Luis Hernández Encinas, Araceli Queiruga‐Dios

Newer variants of the Fujisaki–Okamoto transformation are used in most candidates of the third round of the NIST Post-Quantum Cryptography standardization call in the category of public key encryption schemes. These transformations are applied to obtain a highly secure key encapsulation mechanism from a less secure public key encryption scheme. Furthermore, there are five candidates (three finalists and two alternatives) that passed to the third round of the process and whose security is based in lattice problems. This work analyzes the different ways in which the lattice-based candidates of the NIST call apply the Fujisaki–Okamoto transformation and the particularities of each application. The study of such differences and their repercussion in the design of the proposals will allow a better understanding of the algorithms. Moreover, we propose a modification of the Kyber algorithm—the only public key encryption candidate established as a PQC standard by NIST in its more recent publication—in order to avoid the re-encryption in the decapsulation algorithm and, in this way, to reduce the side channel attacks vulnerability.

Mathematics•Aug 17, 2022•2 citations

Applying the Fujisaki-Okamoto Conversion to Certificate-based Encryption

Yang Lu, Jiguo Li, Junmo Xiao

The Fujisaki-Okamoto (FO) conversion is a generic conversion to enhance a public key encryption scheme with security of one-way against chosen plaintext attacks (OW-CPA) to security of indistinguishable against adaptive chosen ciphertext attacks (IND-CCA) in the random oracle model. Existing works have shown that the FO conversion also can generically upgrade the security of the identity-based encryption (IBE) schemes or certificateless public key encryption (CL-PKE) schemes. However, it is still unknown if the same holds for certificate-based encryption (CBE) schemes. In this paper, we investigate the generic security of the CBE scheme obtained by applying the FO conversion to an arbitrary underlying OW-CBE-CPA secure CBE scheme and confirm that the FO conversion can generically convert any OW-CBE-CPA secure CBE into an IND-CBE-CCA secure CBE. We also note that the straightforward application of the FO conversion only leads to a CBE scheme with a loose reduction. To solve this problem, we propose an enhanced FO conversion which just introduces minor extra computation overhead, but results in considerably more efficient security reduction.

International Symposium on Electronic Commerce and Security•Jan 1, 2008•10 citations

FrodoKEM: A CCA-Secure Learning With Errors Key Encapsulation Mechanism

Lewis Glabush, Patrick Longa, Michael Naehrig +3 more

Large-scale quantum computers capable of implementing Shor's algorithm pose a significant threat to the security of the most widely used public-key cryptographic schemes. This risk has motivated substantial efforts by standards bodies and government agencies to identify and standardize quantum-safe cryptographic systems. Among the proposed solutions, lattice-based cryptography has emerged as the foundation for some of the most promising protocols. This paper describes FrodoKEM, a family of conservative key-encapsulation mechanisms (KEMs) whose security is based on generic, “unstructured” lattices. FrodoKEM is proposed as an alternative to the more efficient lattice schemes that utilize algebraically structured lattices, such as the recently standardized ML-KEM scheme. By relying on generic lattices, FrodoKEM minimizes the potential for future attacks that exploit algebraic structures while enabling simple and compact implementations. Our plain C implementations demonstrate that, despite its conservative design and parameterization, FrodoKEM remains practical. For instance, the full protocol at NIST security level 1 runs in approximately 0.97 ms on a server-class processor, and 4.98 ms on a smartphone-class processor. FrodoKEM obtains (single-target) IND-CCA security using a variant of the Fujisaki-Okamoto transform, applied to an underlying public-key encryption scheme called FrodoPKE. In addition, using a new tool called the Salted Fujisaki-Okamoto (SFO) transform, FrodoKEM is also shown to tightly achieve multi-target security, without increasing the FrodoPKE message length and with a negligible performance impact, based on the multi-target IND-CPA security of FrodoPKE.

IACR Communications in Cryptology•Oct 6, 2025•6 citations

Enhancing Post-Quantum KEMs: A Secure and Efficient Transformation

Sai Charan Reddy Nevuri

This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by$72-79 {\%}$across security levels, with only a modest increase in encapsulation cost$(1.8-7.3 {\%})$and ciphertext size$(1.0-2.1 {\%})$. The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.

International Symposium on Digital Forensics and Security (ISDFS)•Mar 19, 2026•0 citations

Lattice-based Fuzzy Conditional Proxy Re-encryption

Baohong Li, JieFei Xu, Yanzhi Liu

As an extension to conditional proxy re-encryption, fuzzy conditional proxy re-encryption allows for a proxy to re-encrypt a ciphertext only if it satisfies some t-out-of-d threshold condition. Therefore, it is more desirable in some applications where fine-grained control of the decryption delegation is required. In this paper, we construct the first lattice-based fuzzy conditional proxy re-encryption scheme as a post-quantum alternative to this primitive. In our construction, original ciphertexts and re-encryption ciphertexts have the same form, thus only one decryption algorithm is needed for both kinds of ciphertexts. We formalize its security model and prove that it is selective secure under the LWE assumption.

網際網路技術學刊•Sep 1, 2019•1 citation
Chosen ciphertext security for lattice based encryption schemes is generally achieved through a generic transformation such as the Fujisaki-Okamoto transformation. This method requires full re-encryption of the plaintext during decapsulation, which typically dominates the cost of the latter procedure. In this work we show that it is possible to develop alternative transformations specifically designed for lattice based encryption schemes. We propose two novel chosen ciphertext transformations, ETC1 and ETC2, in which re-encryption is replaced by checking the error term of the input ciphertext. We show that our new ciphertext validity check can be securely applied to lattice based encryption schemes under specific conditions. For the NIST post-quantum standardization candidate Threebears we show a speed-up for decapsulation of up to 37.4%. Moreover, as our method only changes the validation check during decapsulation, it is fully backwards compatible with existing implementations of the Fujisaki-Okamoto transformation.
In this paper, we rethink the ciphertext equality check step of the decapsulation procedure of Saber, which is one out of four KEM finalists in the third round NIST PQC standardization process. Through this investigation, we pursue cryptographic answers to some important questions. Those are why the re-encryption process of Fujisaki-Okamoto transformation, which is commonly used method to satisfy IND-CCA security in most existing lattice-based KEM algorithms including Saber, is especially necessary in the case of Saber, whether the re-encryption process can be further simplified, and whether the ciphertext equality check must be performed over the entire (re-encrypted/originally received) ciphertexts?
Newer variants of the Fujisaki–Okamoto transformation are used in most candidates of the third round of the NIST Post-Quantum Cryptography standardization call in the category of public key encryption schemes. These transformations are applied to obtain a highly secure key encapsulation mechanism from a less secure public key encryption scheme. Furthermore, there are five candidates (three finalists and two alternatives) that passed to the third round of the process and whose security is based in lattice problems. This work analyzes the different ways in which the lattice-based candidates of the NIST call apply the Fujisaki–Okamoto transformation and the particularities of each application. The study of such differences and their repercussion in the design of the proposals will allow a better understanding of the algorithms. Moreover, we propose a modification of the Kyber algorithm—the only public key encryption candidate established as a PQC standard by NIST in its more recent publication—in order to avoid the re-encryption in the decapsulation algorithm and, in this way, to reduce the side channel attacks vulnerability.
The Fujisaki-Okamoto (FO) conversion is a generic conversion to enhance a public key encryption scheme with security of one-way against chosen plaintext attacks (OW-CPA) to security of indistinguishable against adaptive chosen ciphertext attacks (IND-CCA) in the random oracle model. Existing works have shown that the FO conversion also can generically upgrade the security of the identity-based encryption (IBE) schemes or certificateless public key encryption (CL-PKE) schemes. However, it is still unknown if the same holds for certificate-based encryption (CBE) schemes. In this paper, we investigate the generic security of the CBE scheme obtained by applying the FO conversion to an arbitrary underlying OW-CBE-CPA secure CBE scheme and confirm that the FO conversion can generically convert any OW-CBE-CPA secure CBE into an IND-CBE-CCA secure CBE. We also note that the straightforward application of the FO conversion only leads to a CBE scheme with a loose reduction. To solve this problem, we propose an enhanced FO conversion which just introduces minor extra computation overhead, but results in considerably more efficient security reduction.
Large-scale quantum computers capable of implementing Shor's algorithm pose a significant threat to the security of the most widely used public-key cryptographic schemes. This risk has motivated substantial efforts by standards bodies and government agencies to identify and standardize quantum-safe cryptographic systems. Among the proposed solutions, lattice-based cryptography has emerged as the foundation for some of the most promising protocols. This paper describes FrodoKEM, a family of conservative key-encapsulation mechanisms (KEMs) whose security is based on generic, “unstructured” lattices. FrodoKEM is proposed as an alternative to the more efficient lattice schemes that utilize algebraically structured lattices, such as the recently standardized ML-KEM scheme. By relying on generic lattices, FrodoKEM minimizes the potential for future attacks that exploit algebraic structures while enabling simple and compact implementations. Our plain C implementations demonstrate that, despite its conservative design and parameterization, FrodoKEM remains practical. For instance, the full protocol at NIST security level 1 runs in approximately 0.97 ms on a server-class processor, and 4.98 ms on a smartphone-class processor. FrodoKEM obtains (single-target) IND-CCA security using a variant of the Fujisaki-Okamoto transform, applied to an underlying public-key encryption scheme called FrodoPKE. In addition, using a new tool called the Salted Fujisaki-Okamoto (SFO) transform, FrodoKEM is also shown to tightly achieve multi-target security, without increasing the FrodoPKE message length and with a negligible performance impact, based on the multi-target IND-CPA security of FrodoPKE.
This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by72−79%72-79 {\%}72−79%across security levels, with only a modest increase in encapsulation cost(1.8−7.3%)(1.8-7.3 {\%})(1.8−7.3%)and ciphertext size(1.0−2.1%)(1.0-2.1 {\%})(1.0−2.1%). The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.
As an extension to conditional proxy re-encryption, fuzzy conditional proxy re-encryption allows for a proxy to re-encrypt a ciphertext only if it satisfies some t-out-of-d threshold condition. Therefore, it is more desirable in some applications where fine-grained control of the decryption delegation is required. In this paper, we construct the first lattice-based fuzzy conditional proxy re-encryption scheme as a post-quantum alternative to this primitive. In our construction, original ciphertexts and re-encryption ciphertexts have the same form, thus only one decryption algorithm is needed for both kinds of ciphertexts. We formalize its security model and prove that it is selective secure under the LWE assumption.