IACR Communications in Cryptology

StarFortress:

Deirdre Connolly, Paul Grubbs

Published May 4, 2026• 1 citation

Abstract

This short paper formally specifies and analyzes the UG hybrid KEM construction from the IRTF CFRG's recent draft on hybrid (post-quantum/traditional) KEMs. The UG construction is an optimized hybrid of a Diffie-Hellman (DH)-based KEM in a nominal group and a generic IND-CCA KEM. The main optimization is that the group elements derived in the DH-based KEM are “inlined” in the key derivation, saving unnecessary hashing. We perform two security analyses of the UG construction: one shows UG is IND-CCA even if the generic IND-CCA KEM is broken; the other complementary analysis shows UG is IND-CCA even if the DH assumptions in the nominal group are broken (by, e.g., a cryptographically-relevant quantum computer).

DOI: 10.62056/ahmp-49p1

Related papers

CCA Secure IB-KEM from the Computational Bilinear Diffie-Hellman Assumption in the Standard Model

Yu Chen, Liqun Chen, Zongyang Zhang

Lecture notes in computer scienceJan 1, 20126 citations

Post-quantum IND-CCA-secure KEM without Additional Hash.

Haodong Jiang, Zhenfeng Zhang, Long Chen +2 more

Jan 1, 201711 citations

Hybrid KEM constructions from classical PKEs and post-quantum KEMs

Bo Zhou, Yukai Zhang, Haodong Jiang +1 more

Abstract The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, accelerating the transition toward post-quantum cryptography (PQC). During this migration, hybrid key encapsulation mechanisms (KEMs) that combine classical and post-quantum primitives are strongly recommended by standardization bodies and cybersecurity agencies. However, existing hybrid designs mainly focus on combining post-quantum KEMs with Diffie–Hellman–style constructions, while the systematic integration of standardized classical public-key encryption (PKE) schemes with post-quantum KEMs remains largely unexplored. In this work, we introduce two generic hybrid constructions, and , that combine a classical PKE scheme with a post-quantum KEM satisfying ciphertext second-preimage resistance (C2PRI). We prove that both constructions achieve IND-CCA security in the standard model. The refined construction additionally relies on a new security notion of the classical PKE scheme, termed partial ciphertext second-preimage resistance (PC2PRI), which captures second-preimage resistance when a designated ciphertext component is fixed. This new property enables shared-key derivation from only a designated PKE ciphertext component in . Finally, we provide a systematic analysis of the PC2PRI property for several standardized classical encryption schemes, including ECIES, PSEC, and SM2.

CybersecurityOct 28, 20260 citations

AH-KEM: Adaptive Hybrid Key Encapsulation Mechanism for Post-Quantum Secure Cloud Communication

Dvvit Patel, Krish Patel, Aaryan Lunis +1 more

IEEE International Conference on Public Key Infrastructure and its Applications (PKIA)Sep 1, 20260 citations

Security and Performance Evaluation of Hybrid Classical-Post-Quantum Cryptographic Models

Rashmi R. Welekar, Charanjeet Dadiyala, Harshala Shingne +2 more

International Conference on Trends in Quantum Computing and Emerging Business Technologies (TQCEBT)Apr 1, 20260 citations

Post-Quantum Cryptographic Analysis of SSH

Benjamin Benčina, Benjamin Dowling, Varun Maram +1 more

The Secure Shell (SSH) protocol is one of the first security protocols on the Internet to upgrade itself to resist attacks against future quantum computers, with the default adoption of the “quantum (otherwise, classically)” secure hybrid key exchange in OpenSSH from April 2022. However, there is a lack of a comprehensive security analysis of this quantum-resistant version of SSH in the literature: related works either focus on the hybrid key exchange in isolation and do not consider security of the overall protocol, or analyze the protocol in security models which are not appropriate for SSH, especially in the “post-quantum” setting. In this paper, we remedy the state of affairs by providing a thorough post-quantum cryptographic analysis of SSH. We follow a “top-down” approach wherein we first prove security of SSH in a more appropriate model, namely, our post-quantum extension of the so-called authenticated and confidential channel establishment (ACCE) protocol security model; our extension which captures “harvest now, decrypt later” attacks could be of independent interest. Then we establish the cryptographic properties of SSH's underlying primitives, as concretely instantiated in practice, based on our protocol-level ACCE security analysis: for example, we prove relevant cryptographic properties of “Streamlined NTRU Prime”, a key encapsulation mechanism (KEM) which is used in recent versions of OpenSSH and TinySSH, in the quantum random oracle model, and address open problems related to its analysis in the literature. Notably, our ACCE security analysis of post-quantum SSH relies on the weaker notion of IND-CPA security of the ephemeral KEMs used in the hybrid key exchange. This is in contrast to prior works which rely on the stronger assumption of IND-CCA secure ephemeral KEMs. Hence we conclude the paper with a discussion on potentially replacing IND-CCA secure KEMs in current post-quantum implementations of SSH with simpler and faster IND-CPA secure counterparts, and also provide the corresponding benchmarks.

IEEE Symposium on Security and Privacy (S&P)May 12, 20254 citations