Tighter Proofs of CCA Security in the Quantum Random Oracle Model

Abstract

We revisit the construction of IND-CCA secure key encapsulation mechanisms (KEM) from public-key encryption schemes (PKE). We give new, tighter security reductions for several constructions. Our main result is an improved reduction for the security of the U ⊥ -transform of Hofheinz, Hövelmanns, and Kiltz (TCC'17) which turns OW-CPA secure deterministic PKEs into IND-CCA secure KEMs. This result is enabled by a new one-way to hiding (O2H) lemma which gives a tighter bound than previous O2H lemmas in certain settings and might be of independent interest. We extend this result also to the case of PKEs with non-zero decryption failure probability and non-deterministic PKEs. However, we assume that the derandomized PKE is injective with overwhelming probability. In addition, we analyze the impact of different variations of the U ⊥transform discussed in the literature on the security of the final scheme. We consider the difference between explicit (U ⊥ ) and implicit (U ⊥ ) rejection, proving that security of the former implies security of the latter. We show that the opposite direction holds if the scheme with explicit rejection also uses key confirmation. Finally, we prove that (at least from a theoretic point of view) security is independent of whether the session keys are derived from message and ciphertext (U ⊥ ) or just from the message (U ⊥ m ).

EasyPQC: Verifying Post-Quantum Cryptography

“…We can axiomatize O2H results in a similar way to what was done for semi-constant and small-range distributions, as long as these results are used to hop between games whose code does not perform measurements. Indeed, we could formalize variant (1) of the O2H theorem in [1] even though it relies on a semi-classical oracle, by using that form stated in [13]: since the semi-classical oracle is only used to define an event that is used to bound the distance between the two games, we can state the axiom by moving the measurement step inside the adversary and redefining that event over the adversary's output. However, formalizing proofs that explicitly manipulate semi-classical oracles would require extending the tool to allow capturing the measurement operation.…”

“…For instance in [1], the notion of a semiclassical oracle is introduced, where an event that determines the security bound is defined based on a measurement. We can capture such bounds in our system whenever they can be recast by moving the final measurement step in reduction to the adversaries and quantifying existentially over adversaries, as described in [13]. We provide more details in Section 8.…”

Scalable Ciphertext Compression Techniques for Post-quantum KEMs and Their Applications

“…The FO transform (roughly) converts any IND-CPA secure PKE into an IND-CCA secure KEM. There are several variants of the FO transform and most of the variants are secure in the ROM [18,23,28,45] and/or QROM [15,28,[33][34][35][36]48,50,53]. The high-level construction is as follows: to encrypt, we sample a random message M M and derive randomness for the underlying encryption algorithm of the PKE by hashing M with a hash function G modeled as a (Q)RO.…”

“…Some schemes may require an upper bound on N since the concrete provably-secure parameters may have a dependance on N , e.g., the reduction loss degrades by a factor of 1/N . Our proposal does not require such an upper bound since N only shows up in a statistical manner, and so we can handle large N , say N = 2 15 , without having any large impact on the concrete parameter choice.…”

“…2. We emphasize that this tweak cannot be made in general since the security proofs may hinge on the fact that the adversary does not learn decapsulation failures (see [15,48]).…”