FO-like Combiners and Hybrid Post-Quantum Cryptography

Abstract

Combining several primitives together to offer greater security is an old idea in cryptography. Recently, this concept has resurfaced as it could be used to improve trust in new Post-Quantum (PQ) schemes and smooth the transition to PQ cryptography. In particular, several ways to combine key exchange mechanisms (KEMs) into a secure hybrid KEM have been proposed. In this work, we observe that most PQ KEMs are built using a variant of the Fujisaki-Okamoto (FO) transform. Thus, we propose several efficient combiners that take OW-CPA public-key encryption schemes (PKEs) and directly build hybrid IND-CCA KEMs. Our constructions are secure in the ROM and QROM and can be seen as generalizations of the FO transform. We also study how the hash functions (ROs) used in our transforms can be combined in order to improve efficiency and security. In a second part, we implement a hybrid KEM using one of our combiners as a proof-of-concept and benchmark it. More precisely, we build a hybrid IND-CCA KEM from the CPAsecure versions of HQC and LAC, two NIST Round 2 PQ proposals. We show that the resulting KEM offers comparable performances to HQC, thus improving security at a small cost. Finally, we discuss which PQ schemes should be combined in order to offer the best efficiency/security trade-off.

Hybrid Keys in Practice: Combining Classical, Quantum and Post-Quantum Cryptography

“…--Yes FO-wise primitives [10] IND-CCA Q-ROM No works focused on the theoretical design of robust combiners, others considered the applicability and practicability these hybrid solutions. Stebila et al [12] propose an evaluation of the applicability of the dual-PRF combiner proposed by [9].…”

“…Notably, they employ combiners suggested by [5], [9], supporting the relevance of a dual-PRF combiner. Furthermore, Azarderakhsh et al [7] and Huguenin-Dumittan and Vaudenay [10] take another direction. In [7], the authors propose a quantum-secure combiner that couples ECDH and Supersingular Isogeny Key Encapsulation (SIKE) [18] protocols.…”

“…They implemented their proposal on a FPGA platform. In [10], the authors propose a solution that does not require extra primitives such as special types of PRFs or MACs. They focus on bypassing the intermediate KEM constructions by involving much higher-level primitives, i.e.…”

“…Recently, several ways to combine either KEX protocols or KEMs into a secure hybrid system have been proposed [5], [7]- [10]. A study from the European Network and Information Security Agency (ENISA) [11] suggests deploying post-quantum cryptography as an extra layer to pre-quantum cryptography.…”

On Multiple Encryption for Public-Key Cryptography

“…They formalized the concept of quantum adversaries and their capabilities. The efficient construction of hybrid PQC-KEM combiners from weaker PKEs as a generalization of the Fujisaki-Okamoto (FO) transform was considered by Huguenin-Dumittan and Vaudenay [27]. A systematic mapping study for post-quantum hybrid key exchange was conducted by Giron et al [8].…”