Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Cybersecurity

Hybrid KEM constructions from classical PKEs and post-quantum KEMs

Bo Zhou, Yukai Zhang, Haodong Jiang, Yunlei Zhao

Published Oct 28, 2026• 0 citations
PDF (CC BY)Publisher

Abstract

Abstract The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, accelerating the transition toward post-quantum cryptography (PQC). During this migration, hybrid key encapsulation mechanisms (KEMs) that combine classical and post-quantum primitives are strongly recommended by standardization bodies and cybersecurity agencies. However, existing hybrid designs mainly focus on combining post-quantum KEMs with Diffie–Hellman–style constructions, while the systematic integration of standardized classical public-key encryption (PKE) schemes with post-quantum KEMs remains largely unexplored. In this work, we introduce two generic hybrid constructions, and , that combine a classical PKE scheme with a post-quantum KEM satisfying ciphertext second-preimage resistance (C2PRI). We prove that both constructions achieve IND-CCA security in the standard model. The refined construction additionally relies on a new security notion of the classical PKE scheme, termed partial ciphertext second-preimage resistance (PC2PRI), which captures second-preimage resistance when a designated ciphertext component is fixed. This new property enables shared-key derivation from only a designated PKE ciphertext component in . Finally, we provide a systematic analysis of the PC2PRI property for several standardized classical encryption schemes, including ECIES, PSEC, and SM2.

DOI
10.1186/s42400-026-00624-0

Related papers

Post-Quantum Variants of ISO/IEC Standards: Compact Chosen Ciphertext Secure Key Encapsulation Mechanism from Isogenies

Kazuki Yoneyama

ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are smaller than these of SIKE, which is submitted to NIST's post-quantum cryptosystems standardization, for current security analyses. Moreover, though SIKE is proved in the classical random oracle model, CSIDH-PSEC-KEM is proved in the quantum random oracle model. Finally, we discuss difficulty to construct isogeny-based KEM from ISO/IEC KEM schemes in the standard model (i.e., ACE-KEM and FACE-KEM).

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Dec 31, 2020•5 citations

Post-Quantum Variants of ISO/IEC Standards

Kazuki Yoneyama

ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are about five times smaller than these of SIKE-KEM which is submitted to NIST's post-quantum cryptosystems standardization.

•Nov 7, 2019•12 citations

A Survey of Post Quantum Key Encapsulation Mechanism

Manjiri Harmalkar, Kurunandan Jain, Prabhakar Krishnan

Classical public-key cryptographic algorithms like the RSA algorithm and Diffie-Hellman are used to secure internet communications. However, the emergence of quantum computers poses a significant threat to these established algorithms, potentially leading to security breaches and malicious attacks. If quantum computers can break these algorithms, the entire security infrastructure of the internet could be compromised. Post- quantum cryptography (PQC) is a cryptographic area dedicated to developing new encryption and key exchange mechanisms that can resist quantum attacks. Its goal is to create quantum-resistant cryptographic algorithms, with NIST playing a central role in standardization and collaboration to ensure information security in the era of quantum computing. This study conducts a survey of Key Encapsulation Mechanism (KEM) algorithms within the field of Post-Quantum Cryptography (PQC), along with their alternative counterparts. It provides a comprehensive analysis of performance metrics, including key sizes, execution times, and runtime performance, specifically focusing on Key Encapsulation Mechanism (KEM) algorithms.

International Conference on Mobile Computing and Sustainable Informatics (ICMCSI)•Jan 18, 2024•23 citations

A Hybrid RSA And ML-KEM Framework For Secure And Quantum-Resilient Communication

Karishma Dobhal, Y.P. Raiwani

Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.

International Journal of Science Engineering and Technology•Jul 31, 2026•0 citations

Hybrid Key Encapsulation Mechanisms

Goncalves, Brian

Quantum computers pose a long-term threat to many currently used cryptographic schemes as they are able to efficiently solve the computational problems those schemes are based on. This threat has lead to research into quantum-resistant cryptographic schemes to eventually replace those currently used, as well as research into how to ease the transition from classical schemes to quantum-resistant ones. One approach to address these issues is to use a combiner that creates hybrid schemes, that is schemes which are classically and quantum-resistant, to protect against quantum attacks and maintain current security guarantees. Such combiners are used as a way to provide trust from different schemes and their differing computational difficulty assumptions rather than a single scheme. which may later become vulnerable. An important type of scheme that must be secure against both classical and quantum attacks are key encapsulation mechanisms (KEMs), as they are commonly used for constructing public-key encryption and key exchange protocols. We first define new security notions for KEMs modeling attackers of various levels of quantum power ranging from fully classical to fully quantum. We then construct a combiner that creates hybrid schemes for key encapsulation mechanisms which is secure against adversaries with varying levels of quantum power over time and can be implemented efficiently. Our construction provides an efficient method to combine KEMs using an additional scheme. This construction is also general enough that it can be implemented in settings such as key exchange protocols, like those used in the Transport Layer Security (TLS) protocol for web browsers, without affecting existing structure meaningfully.

•Jan 1, 2018•0 citations

Enhancing Post-Quantum KEMs: A Secure and Efficient Transformation

Sai Charan Reddy Nevuri

This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by$72-79 {\%}$across security levels, with only a modest increase in encapsulation cost$(1.8-7.3 {\%})$and ciphertext size$(1.0-2.1 {\%})$. The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.

International Symposium on Digital Forensics and Security (ISDFS)•Mar 19, 2026•0 citations
Abstract The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, accelerating the transition toward post-quantum cryptography (PQC). During this migration, hybrid key encapsulation mechanisms (KEMs) that combine classical and post-quantum primitives are strongly recommended by standardization bodies and cybersecurity agencies. However, existing hybrid designs mainly focus on combining post-quantum KEMs with Diffie–Hellman–style constructions, while the systematic integration of standardized classical public-key encryption (PKE) schemes with post-quantum KEMs remains largely unexplored. In this work, we introduce two generic hybrid constructions, and , that combine a classical PKE scheme with a post-quantum KEM satisfying ciphertext second-preimage resistance (C2PRI). We prove that both constructions achieve IND-CCA security in the standard model. The refined construction additionally relies on a new security notion of the classical PKE scheme, termed partial ciphertext second-preimage resistance (PC2PRI), which captures second-preimage resistance when a designated ciphertext component is fixed. This new property enables shared-key derivation from only a designated PKE ciphertext component in . Finally, we provide a systematic analysis of the PC2PRI property for several standardized classical encryption schemes, including ECIES, PSEC, and SM2.
ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are smaller than these of SIKE, which is submitted to NIST's post-quantum cryptosystems standardization, for current security analyses. Moreover, though SIKE is proved in the classical random oracle model, CSIDH-PSEC-KEM is proved in the quantum random oracle model. Finally, we discuss difficulty to construct isogeny-based KEM from ISO/IEC KEM schemes in the standard model (i.e., ACE-KEM and FACE-KEM).
ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are about five times smaller than these of SIKE-KEM which is submitted to NIST's post-quantum cryptosystems standardization.
Classical public-key cryptographic algorithms like the RSA algorithm and Diffie-Hellman are used to secure internet communications. However, the emergence of quantum computers poses a significant threat to these established algorithms, potentially leading to security breaches and malicious attacks. If quantum computers can break these algorithms, the entire security infrastructure of the internet could be compromised. Post- quantum cryptography (PQC) is a cryptographic area dedicated to developing new encryption and key exchange mechanisms that can resist quantum attacks. Its goal is to create quantum-resistant cryptographic algorithms, with NIST playing a central role in standardization and collaboration to ensure information security in the era of quantum computing. This study conducts a survey of Key Encapsulation Mechanism (KEM) algorithms within the field of Post-Quantum Cryptography (PQC), along with their alternative counterparts. It provides a comprehensive analysis of performance metrics, including key sizes, execution times, and runtime performance, specifically focusing on Key Encapsulation Mechanism (KEM) algorithms.
Classical public-key cryptography, mainly RSA, is at risk from the emergence of quantum computers. A complete shift to Post-Quantum Cryptography (PQC) faces vulnerabilities due to implementation and trust issues, despite NIST's approval of standards such as ML-KEM (Kyber). This paper presented a performance and bandwidth trade-off study of a proposed Hybrid Key Encapsulation Mechanism that fused the NIST-standardized ML-KEM-768 (FIPS 203) with the traditional RSA-3072. Two separate secret keys S1 and S2 were produced and encapsulated utilizing both classical and post-quantum public keys in our dual-layered model. In order to create a strong session key that ensures trust transition and backward compatibility with current network infrastructures, these secrets were then combined using a Hybrid Key Derivation Function (HKDF). In comparison to standalone systems, the study assessed the computational cost and communication latency brought about by this hybrid overhead. According to experimental data, the hybrid architecture offers a crucial security fail-safe against both classical flaws and future quantum threats without prohibitively high performance, even though it increases ciphertext size.
Quantum computers pose a long-term threat to many currently used cryptographic schemes as they are able to efficiently solve the computational problems those schemes are based on. This threat has lead to research into quantum-resistant cryptographic schemes to eventually replace those currently used, as well as research into how to ease the transition from classical schemes to quantum-resistant ones. One approach to address these issues is to use a combiner that creates hybrid schemes, that is schemes which are classically and quantum-resistant, to protect against quantum attacks and maintain current security guarantees. Such combiners are used as a way to provide trust from different schemes and their differing computational difficulty assumptions rather than a single scheme. which may later become vulnerable. An important type of scheme that must be secure against both classical and quantum attacks are key encapsulation mechanisms (KEMs), as they are commonly used for constructing public-key encryption and key exchange protocols. We first define new security notions for KEMs modeling attackers of various levels of quantum power ranging from fully classical to fully quantum. We then construct a combiner that creates hybrid schemes for key encapsulation mechanisms which is secure against adversaries with varying levels of quantum power over time and can be implemented efficiently. Our construction provides an efficient method to combine KEMs using an additional scheme. This construction is also general enough that it can be implemented in settings such as key exchange protocols, like those used in the Transport Layer Security (TLS) protocol for web browsers, without affecting existing structure meaningfully.
This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by72−79%72-79 {\%}72−79%across security levels, with only a modest increase in encapsulation cost(1.8−7.3%)(1.8-7.3 {\%})(1.8−7.3%)and ciphertext size(1.0−2.1%)(1.0-2.1 {\%})(1.0−2.1%). The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.