Anonymous, Robust Post-quantum Public Key Encryption

Abstract

A core goal of the NIST PQC competition is to produce public-key encryption (PKE) schemes which, even if attacked with a large-scale quantum computer, maintain the security guarantees needed by applications. The main security focus in the NIST PQC context has been IND-CCA security, but other applications demand that PKE schemes provide anonymity (Bellare et al., ASIACRYPT 2001), and robustness (Abdalla et al., TCC 2010). Examples of such applications include anonymous communication systems, cryptocurrencies, anonymous credentials, searchable encryption, and auction protocols. Almost nothing is known about how to build post-quantum PKE schemes offering these security properties. In particular, the status of the NIST PQC candidates with respect to anonymity and robustness is unknown. This paper initiates a systematic study of anonymity and robustness for post-quantum PKE schemes. Firstly, we identify implicit rejection as a crucial design choice shared by most post-quantum KEMs, show that implicit rejection renders prior results on anonymity and robustness for KEM-DEM PKEs inapplicable, and transfer prior results to the implicit-rejection setting where possible. Secondly, since they are widely used to build post-quantum PKEs, we examine how the Fujisaki-Okamoto (FO) transforms (Fujisaki and Okamoto, Journal of Cryptology 2013) confer robustness and enhance weak anonymity of a base PKE. We then leverage our theoretical results to study the anonymity and robustness of three NIST KEM finalists-Saber, Kyber, and Classic McEliece-and one alternate, FrodoKEM. Overall, our findings for robustness are definitive: we provide positive robustness results for Saber, Kyber, and FrodoKEM, and a negative result for Classic McEliece. Our negative result stems from a striking property of KEM-DEM PKE schemes built with the Classic McEliece KEM: for any message m, we can construct a single hybrid ciphertext c which decrypts to the chosen m under any Classic McEliece private key. Our findings for anonymity are more mixed: we identify barriers to proving anonymity for Saber, Kyber, and Classic McEliece. We also found that in the case of Saber and Kyber, these barriers lead to issues with their IND-CCA security claims. We have worked with the Saber and Kyber teams to fix these issues, but they remain unresolved. On the positive side, we were able to prove anonymity for FrodoKEM and a variant of Saber introduced by D'Anvers et al. (AFRICACRYPT 2018). Our analyses of these two schemes also identified technical gaps in their IND-CCA security claims, but we were able to fix them.strong robustness property (XROB, from [18]), but where the PKE scheme resulting from composing this KEM and DEM is not ANO-CCA secure.Anonymity and robustness from FO transforms. Since all the NIST finalists are KEMs of the implicit rejection type and we have a strong negative result there, we must dig deeper if we wish to assure ourselves that anonymity and robustness will be obtained for PKEs built from those KEMs. This introduces our second main contribution, w...

A Logic and an Interactive Prover for the Computational Post-Quantum Security of Protocols

“…Out of these assumptions, the most debatable w.r.t. instantiability is likely ENC-KP, as discussed recently in [40].…”

KEMTLS with Delayed Forward Identity Protection in (Almost) a Single Round Trip

“…The KEMTLS-PDK protocol [47], in reducing roundtrips, sends the KEM encapsulation against the server's static key in cleartext. Unless an anonymous KEM [4,27,40] is deployed, this value might leak information about the server's identity.…”

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

“…In addition to these security definitions, there are additional security properties that have been discussed in the literature (see, for example, [171,172]). While not required for submission, such properties may be desirable.…”