This paper introduces a high-performance post-quantum Key EncapsulationMechanism (KEM) leveraging structured lattice decoding primitives. The proposedscheme is grounded in a rigorous theoretical framework, providing explicit security reductions to the Module Ring Learning With Errors (Module-RLWE) assumption anda separate Pseudo-Random Generator (PRG) assumption for deterministic sampling.Key technical contributions include: (i) a canonical IND-CPA KEM constructionwhere key encapsulation is cryptographically decoupled from the underlying RLWErandomness; (ii) a formalized deterministic sampler (Expand) utilizing rejectionsampling with explicit smoothing parameter bounds; and (iii) a rigorous applicationof the Leftover Hash Lemma (LHL) supported by detailed min-entropy accounting.To ensure practical reliability, we replace traditional variance heuristics withhigh-probability norm conditioning for precise parameter selection. Furthermore,we provide a comprehensive hybrid reduction sequence with exact loss accounting and define the necessary conditions for an IND-CCA secure variant via theFujisaki-Okamoto transform. The mechanism is optimized for Number TheoreticTransform (NTT) implementations, achieving a balance between provable securityand computational efficiency on modern hardware.
This paper introduces a high-performance post-quantum Key EncapsulationMechanism (KEM) leveraging structured lattice decoding primitives. The proposedscheme is grounded in a rigorous theoretical framework, providing explicit security reductions to the Module Ring Learning With Errors (Module-RLWE) assumption anda separate Pseudo-Random Generator (PRG) assumption for deterministic sampling.Key technical contributions include: (i) a canonical IND-CPA KEM constructionwhere key encapsulation is cryptographically decoupled from the underlying RLWErandomness; (ii) a formalized deterministic sampler (Expand) utilizing rejectionsampling with explicit smoothing parameter bounds; and (iii) a rigorous applicationof the Leftover Hash Lemma (LHL) supported by detailed min-entropy accounting.To ensure practical reliability, we replace traditional variance heuristics withhigh-probability norm conditioning for precise parameter selection. Furthermore,we provide a comprehensive hybrid reduction sequence with exact loss accounting and define the necessary conditions for an IND-CCA secure variant via theFujisaki-Okamoto transform. The mechanism is optimized for Number TheoreticTransform (NTT) implementations, achieving a balance between provable securityand computational efficiency on modern hardware.
This thesis is an in-depth introduction to NIST's post-quantum Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). We begin by introducing the problem at the core of ML-KEM, known as the Module Learning With Errors (MLWE) problem. In this problem, an adversary attempts to distinguish between samples selected from a specific distribution and samples from uniformly random samples. We also discuss the hardness of the MLWE problem, under the conjecture that certain lattice problems over modules are hard. ML-KEM utilizes a variant of the Fujisaki-Okamoto transformation, which employs a weakly secure Public-Key Encryption (PKE) scheme to construct a strongly secure key-encapsulation mechanism in the Random Oracle Model (ROM). We explain the working principle of the MLWE-based public-key encryption scheme and demonstrate how ML-KEM is constructed from it. Finally, we analyze the security of ML-KEM. We provide a tight security bound for IND-CCA security of ML-KEM in ROM, under the assumption that the underlying PKE is IND-CPA secure. Additionally, we present two security theorems in the Quantum Random Oracle Model (QROM). The first theorem establishes non-tightly IND-CCA security of ML-KEM in QROM if the MLWE problem is hard to solve. The second theorem assumes that the deterministic PKE is ciphertext-indistinguishable. Under this assumption, we derive a tighter bound for the IND-CCA security of ML-KEM in QROM.
This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by72−79%across security levels, with only a modest increase in encapsulation cost(1.8−7.3%)and ciphertext size(1.0−2.1%). The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.
Lattice-based cryptography has emerged as a leading approach for post-quantum secure communication, particularly in key exchange mechanisms such as Key Encapsulation Mechanisms (KEMs). Prominent schemes based on Learning with Errors (LWE), Ring-LWE, Module-LWE, and NTRU lattices provide strong resistance to quantum attacks while maintaining practical efficiency. A key factor influencing their performance and security is polynomial sampling, which controls noise generation, randomness, and key distribution. This systematic review examines advancements in lattice-based key exchange mechanisms with a focus on optimized polynomial sampling techniques, based on 30 peer-reviewed studies. The approaches are categorized into algorithmic improvements, hardware acceleration, side-channel resistant sampling, and emerging intelligent optimization methods. Efficient polynomial arithmetic, Number Theoretic Transform (NTT)-based multiplication, and structured lattices significantly enhance performance. Optimized sampling techniques reduce computational cost and energy consumption while preserving statistical accuracy. However, polynomial sampling remains vulnerable to side-channel attacks such as timing and power analysis, prompting the use of countermeasures like constant-time and masked sampling. Hardware implementations further improve efficiency, though challenges persist in balancing scalability, security, and performance, highlighting the need for adaptive and robust solutions.
The ongoing transition to Post-Quantum Cryptography (PQC) has highlighted the need for cryptographic schemes that offer high security, strong performance, and fine-grained parameter selection. In lattice-based cryptography, particularly for the popular module variants of learning with errors (Module-LWE) and learning with rounding (Module-LWR) schemes based on power-of-two cyclotomics, existing constructions often force parameter choices that either overshoot or undershoot desired security levels due to structural constraints. In this work, we introduce a new class of techniques that are the advantages of both worlds: structured Module-LWE (or LWR) embeds more algebraic structure than a module such that it significantly improves performance, yet less structure than a power-of-two cyclotomic ring such that it still enables more flexible and efficient parameter selection. We present two concrete instances: a construction based on a radical extension of a two-power cyclotomic field denoted radical Ring-LWE (RR-LWE) or Ring-LWR (RR-LWR), and a cyclotomic block-ring module lattice approach (BRM-LWE or BRM-LWR). These new structured Module-LWE and LWR reduce the required number of uniformly random bytes in its matrix by a factor up to the module rank and allow efficient NTT implementations while enabling more granular security-performance trade-offs. We analyze the security of these constructions, provide practical parameter sets, and present implementation results demonstrating a performance improvement of up to 37% compared to an optimized implementation of ML-KEM. Our techniques apply to both key encapsulation mechanisms and digital signature schemes, offering a pathway to more adaptable and performant PQC standards.
In the last decade, there has been significant progress in the development of quantum computers, with massive investments by major tech companies. It is assumed that once large-scale quantum computers are built, many commonly used public key cryptosystems will no longer be secure. To prevent quantum attacks, researchers are already working on the design of post-quantum cryptographic protocols, and the US National Institute of Standards and Technology (NIST) is holding an international competition to select new cryptographic standards.Lattice-based cryptographic constructions are promising candidates because they offer strong theoretical security guarantees and can be implemented efficiently. One of the most widely used cryptographic primitives based on lattices is the Learning With Errors (LWE) problem introduced by Regev. Later works have proposed structured variants of LWE such as Ring-LWE and Module-LWE, which allow for a more compact representation.In this thesis, we consider two lattice-based NIST candidates for Key Encapsulation Mechanisms (KEMs) and propose new error correction and reconciliation techniques in order to improve their efficiency, their security, as well as their reliability.Unlike some previous works on error correction for lattice-based protocols, we provide rigorous error probability bounds.We first consider FrodoKEM, a lattice-based cryptosystem based on LWE, and introduce a modified error correction mechanism to improve its performance. Our encoder maps the secret key block-wise into a scaled version of the 8-dimensional Gosset lattice E_8. We propose three sets of parameters for our modified implementation. The first implementation outperforms FrodoKEM in terms of plausible security; the second allows to reduce the bandwidth by halving the modulus, and the third allows to increase key sizes.The second KEM we are considering is KyberKEM, which is based on Module-LWE. We propose a reconciliation technique using the lattice E_8, and show that our scheme can outperform KyberKEM in terms of security with comparable error probability and similar bandwidth requirements. We also investigate the use of higher dimensional lattices for reconciliation.
Current public key cryptosystems that are based on the hardness of integer factorization and discrete logarithm are insecure in the presence of large-scale quantum computers. Much effort has been devoted to replacing the quantum-insecure cryptosystems with newly developed "post-quantum" cryptosystem candidates, conjectured to be secure against quantum attack. Lattice-based cryptography has been widely recognized as a prominent candidate for practical post-quantum security.This dissertation improves the robustness and versatility of lattice-based cryptography through the following three contributions: 1. Chapter 3 introduces a constant-round protocol for unauthenticated group key exchange (i.e., with security against a passive eavesdropper). Group key exchange protocols allow a set of N parties to agree on a shared, secret key by communicating over a public network. Our protocol is based on the hardness of a lattice problem, which hence yields (plausible) post-quantum security. 2. In Chapter 4, we propose a framework for cryptanalysis of lattice-based schemes when certain types of information about the secret are leaked. Our framework generalizes the primal lattice reduction attack. The generalization allows for integrating the leaked information progressively before running a final lattice reduction step. Our framework can estimate the amount of security loss caused by the leaked information, and perform lattice reduction attacks with leaked information when computationally feasible. 3. Chapter 5 introduces an approach towards a ring analogue of the Leftover Hash Lemma (LHL). The LHL is a mathematical tool often used in the analysis of various lattice-based cryptosystems, as well as their leakage-resilient counterparts. However, it does not hold in the ring setting, which is typical for efficient cryptosystems. Lyubashevsky et al. (Eurocrypt '13) proved a "regularity lemma," which is used in the ring setting instead of the LHL; however, this applies only for centered, spherical Gaussian inputs, while the LHL applies when the input is drawn from any high min-entropy distribution. Our approach generalizes the "regularity lemma" of Lyubashevsky et al. to certain conditional distributions. A number of Ring-Learning with Errors based cryptosystems can achieve certain leakage resilience properties using our results.