Tightly Secure PKE Combiner in the Quantum Random Oracle Model

Abstract

The development of increasingly sophisticated quantum computers poses a long-term threat to current cryptographic infrastructure. This has spurred research into both quantum-resistant algorithms and how to safely transition real-world implementations and protocols to quantum-resistant replacements. This transition is likely to be a gradual process due to both the complexity and cost associated with transitioning. One method to ease the transition is the use of classical–quantum hybrid schemes, which provide security against both classical and quantum adversaries. We present a new combiner for creating hybrid encryption schemes directly from traditional encryption schemes. Our construction is the only existing proposal in the literature with $\mathsf{IND}\text{-}\mathsf{CCA}$-security in the classical and quantum random oracle models, respectively.

1. Introduction

As the age of scalable quantum computing comes closer to becoming a reality, research into cryptographic algorithms that are secure against quantum adversaries becomes increasingly important. The transition to new algorithms for real-world applications and protocols has historically been slow. It took nearly two decades [1] for current public-key cryptographic infrastructure to be fully deployed; hence, new post-quantum infrastructure can be expected to take a similar amount of time. Additionally, maintaining legacy systems and addressing concerns of potential downgrade attacks should be considered when the transition begins. Finally, while quantum-resistant schemes have been increasingly studied and analyzed, the underlying hardness assumptions remain relatively novel, in which future cryptanalysis may show that they are vulnerable to quantum attacks or, even worse, classical attacks. As the release of standards is still years away and full deployment of quantum-resistant algorithms is a long-term effort, there is still a need to secure today’s data from quantum adversaries.

Hybrid Cryptography and Combiners. So-called classical–quantum hybrid cryptography, which combines classically secure and quantum-resistant algorithms to produce a new secure scheme, represents a stopgap solution to the dilemma of transitioning from classical to quantum-resistant cryptographic infrastructure and the need to secure data and communications versus the cost, and the time, to fully transition. Harnik et al. [2] formalized this idea of combining algorithms as a $(k,n)$-robust combiner, where n represents the number of inputs and k represents the threshold of secure inputs required to achieve security. Hybrid combiners have been the subject of previous works for various primitives, such as Bindel et al. [3] on hybrid signatures and Bindel et al. [4] on hybrid key encapsulation mechanisms (KEMs) and hybrid authenticated key exchange.

Traditional combiners for public-key encryption (PKE), the focus of this work, have also been studied by Asmuth and Blakely [5], Herzberg [6], and Zhang et al. [7]. However, these previous results either failed to achieve $\mathsf{IND}\text{-}\mathsf{CCA}$-security [6], required every input to be secure [8], or lacked a proof against quantum adversaries [9].

In the place of PKE combiners, there has been successful work in the field of KEM combiners. Giacon et al. presented a swath of different construction of robust $\mathsf{IND}\text{-}\mathsf{CCA}$ combiners for KEMs using different core function constructions to produce the final key [10]. However, the results are limited to only KEMs with perfect correctness, which many quantum-resistant schemes do not have. Bindel et al. additionally provided three more constructions of robust KEM combiners against adversaries with varying levels of quantum capabilities over time [4].

Currently, there is interest in both academia and industry for hybrid cryptography. As mentioned, both Bindel et al. [3], and Bindel et al. [4] constructed hybrid primitives, digital signatures, and KEMs, respectively, with the latter also presenting a design for a hybrid authenticated key exchange built from hybrid KEMs. Mirroring the interest in hybrid cryptography, ISARA and Cisco investigated the viability of hybrid X.509 digital certificates [11] in 2018. Meanwhile, in 2016, Google experimented with combining elliptic curve Diffie–Hellman (ECDH) and ring-learning with errors (R-LWE) key exchange in the transport layer security (TLS) stack in a test version of its Chrome web browser [12,13].

Our Contributions. In this work, we present a (mostly) generic construction of a $(1,2)$-robust combiner for PKEs that preserves $\mathsf{IND}\text{-}\mathsf{CCA}$-security in the random oracle model and in the quantum random oracle model, which we call the Quantum Augmented KEM-DEM (or QuAKe) combiner. Furthermore, the security reduction of our construction is tight in both the classical and, more importantly, quantum random oracle models. We achieve this with the use of two PKEs, one of which we require to be built from the KEM-DEM paradigm put forth by Cramer and Shoup [14], and a pair of random oracles, ${\mathsf{Hash}}_1,{\mathsf{Hash}}_2$. Our construction relies on preventing an adversary from obtaining both the symmetrically encrypted message, along with a random seed, and the asymmetrically encrypted key by encrypting the symmetric ciphertext under the second PKE. By doing this, an adversary can only obtain the encrypted message and key if they were already able to break the security of both the KEM-DEM and the second PKE. Additionally, the random seed is used to guard against re-encryption and re-encapsulation attacks, as well as mix-and-match attacks. We then prove the security reduction of QuAKe is tight in both the classical and quantum random oracle models.

The paper is organized as follows. In Section 2, we define our notation lemmas required for our proof in the quantum random oracle mode and give some preliminary cryptographic definitions. In Section 3, we present our construction and its security. In Section 4, we review previous results on PKE and KEM combiners, and then provide a comparison with previous results. We then conclude our paper in Section 5.

2. Preliminaries

In this section, we cover the preliminaries used in this work. We begin with the notation used, then an introduction to the random oracle model, the security notions and definitions used, and finally define $(k,n)$-robust combiners.

2.1. Notation

By $y\leftarrow \mathcal{A}\left(x\right)$ we denote an algorithm, $\mathcal{A}$ (either classical or quantum), that runs on (classical) input x, and (classical) outputs y. When $\mathcal{A}$ has access to an oracle, $\mathcal{B}$, we write this as $\mathcal{A}{\left(x\right)}^{\mathcal{B}(·)}$. If $\mathcal{A}$ is an algorithm that uses some randomness in its execution on input x and we wish to specify what the randomness is, say r, we denote it as $\mathcal{A}(x;r)$. We refer to specific subroutines within $\mathcal{A}(·)$ as $\mathcal{A}.\mathsf{Subroutine}$. We consider all adversaries as algorithms (either classical or quantum) that are probabilistic polynomial time on their input length.

We write $x\leftarrow \$S$ to denote that x was outputted by S probabilistically, where if S is some algorithm, then x was selected according to some internal distribution, and if S is some space, such as ${\{0,1\}}^l$, then we implicitly mean for x to be sampled uniformly at random.

We say a function g mapping non-negative integers to non-negative reals is called negligible, if for all positive numbers c, there exists an integer ${\lambda }_0\left(c\right)\ge 0$ such that for all $\lambda >{\lambda }_0\left(c\right)$ we have $g\left(\lambda \right)<\frac{1}{{\lambda }^c}$. A family of functions F is called q-wise independent if for any distinct $x_1,\cdots ,x_q$ and for $f\leftarrow \$F$ the values $f\left(x_1\right),\cdots ,f\left(x_q\right)$ are independently uniformly distributed.

2.2. Random Oracle Model and Quantum Random Oracle Model

In this section, we briefly describe the random oracle model (ROM) and quantum random oracle model (QROM) and state the lemmas that will be used in the main result when proving the ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security of QuAKe. We provide a brief introduction to quantum computing in Appendix A and refer to Nielsen and Chuang [15] as a standard text for a more complete explanation.

2.2.1. Random Oracles

In the classical random oracle model (ROM), we assume the existence of a truly random function H and give all parties access to query this function [16]. When implemented, a suitable hash function, $\mathsf{Hash}$, is used in place of H. Any queries to the random oracle, made by any party, is then replaced with an evaluation of $\mathsf{Hash}$ on the query.

As in the ROM, in the quantum random oracle model (QROM), all parties are given access to a random function H, which, when implemented, is replaced by a suitable hash function $\mathsf{Hash}$. However, in quantum settings, since a quantum algorithm can evaluate $\mathsf{Hash}$ in a superposition of inputs, an adversary must also be allowed to query H in superposition. This is called the quantum random oracle model [17]. To denote when superposition access to H is available, we will adopt the notation $\mid H\rangle$.

2.2.2. QROM Lemmas

We next state two useful lemmas regarding quantum random oracles. First is the one-way-to-hiding (O2H) Lemma, proven by Unruh [18]. The O2H lemma, informally, states that if a quantum adversary makes at most q queries to a quantum random oracle, $\mid H\rangle$, and is able to distinguish $(x,H(x\left)\right)$ from $(x,y)$, where y was sampled uniformly at random, then a simulator can recover x by measuring one of the queries to $\mid H\rangle$. In other words, this lemma reduces distinguishing $H\left(x\right)$ from y to guessing x. We present the updated statement of the O2H Lemma as formulated by Ambainis et al. [19].

Lemma 1

(One-way-to-hiding, probabilities).Let $S\subseteq X$ be random. Let $G,H:X\to Y$ be random functions satisfying $\forall x\notin S,G\left(x\right)=H\left(x\right)$. Let z be a random bit string ($S,G,H,z$ may have arbitrary joint distribution). Let $\mathcal{A}$ be a quantum oracle algorithm with query depth q (not necessarily unitary). Let ${\mathcal{B}}^H$ be an oracle algorithm that on input z does the following: pick $i\leftarrow \$\{1,\cdots ,q\}$ run ${\mathcal{A}}^H\left(z\right)$ until (just before) the ith query, measure all query input registers in the computational basis, output the set T of measurement outcomes. Let

$$P_{left}:=Pr[b=1:b\leftarrow {\mathcal{A}}^H\left(z\right)],P_{right}:=Pr[b=1:b\leftarrow {\mathcal{A}}^G\left(z\right)]$$

(1)

$$P_{guess}:=Pr[S\cap T\ne \varnothing :T\leftarrow {\mathcal{B}}^H\left(z\right)].$$

(2)

Then,

$$\left|P_{left}-P_{right}\right|\le 2q\sqrt{P_{guess}},$$

(3)

and

$$\left|\sqrt{P_{left}}-\sqrt{P_{right}}\right|\le 2q\sqrt{P_{guess}}.$$

(4)

We refer to the algorithm $\mathcal{B}$ as the O2H simulator. As noted by Ambainis et al., the original statement of the O2H Lemma by Unruh is a consequence of the updated version [19].

The next lemma concerns simulating quantum random oracles. In the original QROM introduced by Boneh et al. [17], reduction or simulator algorithms are not allowed access to a random oracle, and therefore, must somehow simulate the oracle itself. Zhandry [20] demonstrated that a simulator can use a $2q$-wise independent function to successfully simulate a random oracle, where q denotes the number of queries made by the adversary. Moreover, they proved the simulation of the random oracle is perfect, and no adversary can distinguish between a true random oracle and a $2q$-wise independent function.

Lemma 2.

Let H be an oracle drawn from the set of 2q-wise independent functions uniformly at random. Then, the advantage any quantum algorithm making at most q queries to H has in distinguishing H from a truly random function is identically 0.

For the security reduction of the main result in the QROM, we implicitly assume the use of $2q$-wise independent functions by any simulators to answer the adversary’s oracle queries.

2.3. Public-Key Encryption

In this section, we provide an overview of public-key encryption algorithms and the relevant security definitions. We begin by defining a public-key encryption (PKE) algorithm. We define the correctness of PKEs in Appendix B.

Definition 1

(Public-Key Encryption Scheme).We say a triple of algorithms ${\mathsf{\Pi }}^{\mathit{asym}}=$$(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec})$ form a public-key encryption (PKE) scheme, if:

• $\mathsf{KeyGen}$: the key generation algorithm is a probabilistic algorithm which on input $1^n$$(n\in \mathbb{N})$ outputs a related pair, $(pk,sk)$, of public and secret keys.
• $\mathsf{Enc}$: the encryption algorithm is a probabilistic algorithm that takes two inputs, a public-key $pk$, and a plaintext m, from a designated message space, ${\mathcal{M}}_{{\mathsf{\Pi }}^{\mathit{asym}}}$, and outputs a ciphertext c.
• $\mathsf{Dec}$: the decryption algorithm is a deterministic algorithm that takes as input a secret key $sk$, and ciphertext c, and returns the plaintext m, or a special designated rejection symbol ⊥.

We now define the $\mathsf{IND}\text{-}\mathsf{CCA}$-security (also referred to as $\mathsf{IND}\text{-}\mathsf{CCA}2$-security in the literature) and security experiment for PKEs in the random oracle model.

Definition 2

($\mathsf{IND}\text{-}\mathsf{CCA}$-Security for PKEs in the ROM). We say that a PKE, ${\mathsf{\Pi }}^{\mathit{asym}}$, is $\mathsf{IND}\text{-}\mathsf{CCA}$-secure in the random oracle model if, for all adversaries $\mathcal{A}$, and a random oracle H, we have that

$${\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)=\left|Pr[{\mathsf{Expt}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)-\frac{1}{2}]\right|$$

(5)

is a negligible function in $n\in \mathbb{N}$, where ${\mathrm{Expt}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$ is defined in Algorithm 1.

Algorithm 1 The $\mathsf{IND}\text{-}\mathsf{CCA}$-security experiments for PKEs in the ROM, ${\mathrm{Expt}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$.

1: $(pk,sk)\leftarrow \${\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{KeyGen}\left(1^n\right)$

2: $m_0,m_1,\mathsf{st}\leftarrow {\mathcal{A}}^{{\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Dec}(sk,·),H(·)}\left(pk\right)$

3: $b\leftarrow \$\{0,1\}$

4: $c^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,m_b)$

5: $b^{\prime }\leftarrow {\mathcal{A}}^{{\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Dec}(sk,·\ne c^{*}),H(·)}(pk,\mathsf{st},c^{*})$

6: Return $[b=b^{\prime }]$

In this work, when we discuss security against quantum adversaries, we are considering the case of an adversary with quantum computational powers, including the ability to query the random oracle in superposition but who only has classical access to decryption oracles. We adopt the ${\mathsf{X}}^{\mathsf{y}}\mathsf{Z}$ notation, introduced in Bindel et al. [3], to denote security against such adversaries, where $\mathsf{X}$ denotes whether the adversary is classical or quantum while they have decryption oracle access, $\mathsf{y}$ denotes whether the adversary can perform classical or superposition decryption queries, and $\mathsf{Z}$ denotes whether the adversary is classical or quantum after they lose access to decryption oracles. Thus, $\mathsf{IND}\text{-}\mathsf{CCA}$-security against a quantum adversary with only classical decryption queries in the quantum random oracle model is denoted as ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$. Security against an ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-adversary is defined analogously to Algorithm 1, and we include the full definition in Appendix B.

2.4. Key/Data Encapsulation Mechanisms

In this section, we define both key encapsulation mechanisms (KEMs), data encapsulation mechanisms (DEMs), and the security notions necessary for this work. We then describe the KEM-DEM paradigm to build a public-key encryption algorithm and the necessary conditions to attain $\mathsf{IND}\text{-}\mathsf{CCA}$-security using the paradigm. We define the correctness for both KEMs and DEMs in Appendix B.

First, we define a key encapsulation algorithm [21].

Definition 3

(Key Encapsulation Mechanism).We say the triple of algorithms $\mathcal{K}=$$(\mathsf{KeyGen}$, $\mathsf{Encaps}$,$\mathsf{Decaps})$ form a key encapsulation mechanism (KEM), if:

• $\mathsf{KeyGen}$: the key generation algorithm is a probabilistic algorithm which on input $1^n$$(n\in \mathbb{N})$, outputs a related pair, $(ek,dk)$, of a public encapsulation and secret decapsulation keys.
• $\mathsf{Encaps}$: the encapsulation algorithm is a probabilistic algorithm that takes one input, a public encapsulation key $ek$, and produces a pair of related outputs, a ciphertext c, and an ephemeral key k, from a designated key space ${\mathcal{KS}}_{\mathcal{K}}$.
• $\mathsf{Decaps}$: the decapsulation algorithm is a deterministic algorithm that takes as input a secret decapsulation key $dk$, and ciphertext c, and returns the related ephemeral key k, or a specially designated rejection symbol ⊥.

Note that a KEM can be built from a public-key encryption algorithm by simply sampling a message uniformly at random, to be used as the key, then encrypting it and sending the ciphertext.

The next definition is for $\mathsf{IND}\text{-}\mathsf{CCA}$-security of KEMs. We use the standard model in the following definition, but the definition lifts to the random oracle model in a natural way.

Definition 4

($\mathsf{IND}\text{-}\mathsf{CCA}$-Security for KEMs). We say that a KEM, $\mathcal{K}$, is $\mathsf{IND}\text{-}\mathsf{CCA}$ if, for all adversaries $\mathcal{A}$, we have that

$${\mathsf{Adv}}_{\mathcal{K}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)=\left|Pr[{\mathsf{Expt}}_{\mathcal{K}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)-\frac{1}{2}]\right|$$

(6)

is a negligible function in $n\in \mathbb{N}$, where ${\mathrm{Expt}}_{\mathcal{K}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$ is defined in Algorithm 2.

Algorithm 2 The $\mathsf{IND}\text{-}\mathsf{CCA}$-security experiments for KEMs, ${\mathrm{Expt}}_{\mathcal{K}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$.

1: $(ek,dk)\leftarrow \$\mathcal{K}.\mathsf{KeyGen}\left(1^n\right)$

2: $\mathsf{st}\leftarrow {\mathcal{A}}^{\mathcal{K}.\mathsf{Decaps}(dk,·)}\left(ek\right)$

3: $(c^{*},k_0)\leftarrow \mathcal{K}.\mathsf{Encaps}\left(ek\right)$

4:  $k_1\leftarrow \${\mathcal{KS}}_{\mathcal{K}}$

5: $b\leftarrow \$\{0,1\}$

6: $b^{\prime }\leftarrow {\mathcal{A}}^{\mathcal{K}.\mathsf{Decaps}(dk,·\ne c^{*})}(ek,\mathsf{st},c^{*},k_b)$

7: Return $[b=b^{\prime }]$

We now informally define $\mathsf{IND}\text{-}\mathsf{CCA}$-security for KEMs against quantum adversaries in the QROM. As in the PKE case, this security is an extension of classical $\mathsf{CCA}$-security to the QROM with a quantum adversary that is restricted to only classical decryption queries. Once again, we adopt the ${\mathsf{X}}^{\mathsf{y}}\mathsf{Z}$ notation and refer to this security notion as ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security for KEMs, or simply ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$ when the context is clear.

We now define the symmetric primitive and data encapsulation mechanisms (DEMs) [21].

Definition 5

(Data Encapsulation Mechanism/Symmetric Encryption Scheme).We say a triple of algorithms ${\mathsf{\Pi }}^{\mathit{sym}}=(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec})$ form a (stateless) data encapsulation mechanism (DEM), or symmetric encryption scheme, if:

• $\mathsf{KeyGen}$: the key generation algorithm is a probabilistic algorithm that on input $1^n$$(n\in \mathbb{N})$ outputs a secret key k.
• $\mathsf{Enc}$: the encryption algorithm is a deterministic algorithm that takes two inputs, a secret key k and a plaintext m, from a designated message space ${\mathcal{M}}_{{\mathsf{\Pi }}^{\mathit{sym}}}$, and outputs a ciphertext c.
• $\mathsf{Dec}$: the decryption algorithm is a deterministic algorithm that takes as input a secret key k and ciphertext c, and returns the plaintext m, or a special designated rejection symbol ⊥.

In this work, referring to such an algorithm as a DEM rather than symmetric encryption emphasizes the relation between KEMs and DEMs covered in the next section.

Next, we define the primary security definition for DEMs this work is concerned with, the $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-security introduced by Cramer and Shoup [14]. Informally, $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$ is similar to the $\mathsf{IND}\text{-}\mathsf{CCA}$-security experiment, except that the adversary cannot encrypt any messages of their choice and only after receiving the challenge ciphertext is given access to a decryption oracle. When we wish to consider security of a DEM against a quantum capable adversary, we again make use of the ${\mathsf{X}}^{\mathsf{y}}\mathsf{Z}$ notation and denote $\mathsf{OT}\text{-}\mathsf{CCA}$-security for a DEM against a quantum adversary with only classical decryption queries as ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-security.

Definition 6

($\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-Security for DEMs).We say that a DEM $\mathcal{K}$ is $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$ if, for all adversaries $\mathcal{A}$, we have that:

$${\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{sym}}}^{\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)=\left|Pr[{\mathsf{Expt}}_{{\mathsf{\Pi }}^{\mathit{sym}}}^{\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)-\frac{1}{2}]\right|$$

(7)

is a negligible function in $n\in \mathbb{N}$, where ${\mathrm{Expt}}_{{\mathsf{\Pi }}^{\mathit{sym}}}^{\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$ is defined in Algorithm 3.

Algorithm 3 The $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-security experiments for DEMs, ${\mathrm{Expt}}_{{\mathsf{\Pi }}^{\mathit{sym}}}^{\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)$.

1: $(ek,dk)\leftarrow \$\mathcal{K}.\mathsf{KeyGen}\left(1^n\right)$

2:  $k\leftarrow \${\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{KeyGen}\left(1^n\right)$

3: $m_0,m_1,\mathsf{st}\leftarrow \mathcal{A}\left(1^n\right)$

4: $b\leftarrow \$\{0,1\}$

5: $c^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k,m_b)$

6: $b^{\prime }\leftarrow {\mathcal{A}}^{{\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Dec}(sk,·\ne c^{*})}(\mathsf{st},c^{*})$

7: Return $[b=b^{\prime }]$

KEM-DEM Paradigm

We go on to describe how a public-key encryption system can be built from a KEM and DEM pair.

Intuitively, a KEM can be used to generate a key from the key space of the DEM, which, in turn, is used to encrypt the message. The KEM-DEM paradigm of constructing a PKE was first proposed by Cramer and Shoup [14]. The PKE is built by using the KEM keys as the public and private key, generating a ciphertext–key pair from the KEM, then using the key as the symmetric key to encrypt the message and sending the asymmetric and symmetric ciphertexts. Decryption is defined in the natural way. Traditionally, the KEM-DEM is referred to in the literature as a hybrid scheme, referencing public-key–symmetric-key hybrid. To avoid confusion, we elect to use the term KEM-DEM paradigm instead and use hybrid schemes to refer to classical–quantum hybrid schemes.

In addition to proposing the KEM-DEM paradigm, Cramer and Shoup outlined the necessary conditions on the KEM, $\mathcal{K}$, and DEM, ${\mathsf{\Pi }}^{\mathit{sym}}$, for the resulting PKE, $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$, to achieve $\mathsf{IND}\text{-}\mathsf{CCA}$-security. The following theorem outlines these conditions.

Theorem 1.

If $\mathcal{K}$, a KEM, is $\mathsf{IND}\text{-}\mathsf{CCA}$-secure and ${\mathsf{\Pi }}^{\mathit{sym}}$, a DEM, is $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-secure, then $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$, described in Algorithms 4–6 is an $\mathsf{IND}\text{-}\mathsf{CCA}$-secure PKE.

Algorithm 4$(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}}).\mathsf{KeyGen}\left(1^n\right)$.

1: $(ek,dk)\leftarrow \$\mathcal{K}.\mathsf{KeyGen}\left(1^n\right)$

2: Return $(ek,dk)$

Algorithm 5$(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}}).\mathsf{Enc}(ek,m)$.

1: $(c_1,k)\leftarrow \mathcal{K}.\mathsf{Encaps}\left(ek\right)$

2: $c_2\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k,n)$

3: Return $(c_1,c_2)$

Algorithm 6$(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}}).\mathsf{Dec}(dk,(c_1,c_2))$.

1: $k\leftarrow \mathcal{K}.\mathsf{Decaps}(dk,c_1)$

2: $m\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Dec}(k,c_2)$

We include an informal outline of the proof of Theorem 1.

Since $\mathcal{K}$ is $\mathsf{IND}\text{-}\mathsf{CCA}$-secure, the key used to encrypt the challenge message $k^{*}$ is indistinguishable from a bit string of equal length sampled uniformly at random, say r. The challenger then generates $(c_{KEM}^{*},k^{*})$, but instead of using $k^{*}$ to encrypt the message, r is used. From here, the adversary is then given $(c_{KEM}^{*},c_{{\mathsf{\Pi }}^{\mathit{sym}}}^{*})$ and is effectively in the $\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-security experiment for ${\mathsf{\Pi }}^{\mathit{sym}}$.

We make the observation that the proof of this theorem is also directly applicable in the quantum setting, and as a corollary state the quantum version of Theorem 1.

Corollary 1.

If $\mathcal{K}$, a KEM, is ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-secure and ${\mathsf{\Pi }}^{\mathit{sym}}$, a DEM, is ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{OT}\text{-}\mathsf{CCA}$-secure, then $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$, as described in Algorithms 4–6, is an ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-secure PKE.

2.5. Combiners

In this section, we introduce and formally define robust combiners. We provide a review of previous PKE and KEM combiners in Section 4.

First, we define the notion of a $(k,n)$-robust combiner. Informally, a $(k,n)$-robust combiner is an algorithm that accepts inputs of n of the same type of cryptographic schemes to produce a new cryptographic scheme, and so long as at least k of the inputs satisfies the same security notion the output is also equally secure. The formal definition of a robust combiner was first proposed by Harnik et al. [2] to formalize such combinations.

Definition 7

((k,n)-Robust Combiner).Let $\mathbb{P}$ be a set of cryptographic primitives. A $(k,n)$-robust combiner is an algorithm that gets n candidate schemes from $\mathbb{P}$ as inputs, and whose output is a single algorithm that is secure to some security specification s, if the following holds:

• If at least k candidates securely implement the security specification s, then the result of the combiner also securely implements s.
• The running time of the result of the combiner is polynomial in the security parameter m, in n, and in the lengths of the inputs to $\mathbb{P}$.

3. QuAKe

In this section, we propose the Quantum Augmented KEM-DEM (QuAKe) combiner and then prove it is a $(1,2)$-robust combiner for both $\mathsf{IND}\text{-}\mathsf{CCA}$- and ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security in the classical and quantum random oracle models, respectively.

3.1. Construction

We first outline the QuAKe combiner. Informally, QuAKe encrypts the message with the KEM-DEM scheme, $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$, then encrypts the DEM component of the ciphertext using the second PKE, ${\mathsf{\Pi }}^{\mathit{asym}}$. Intuitively, we prevent an adversary who can break the $\mathsf{IND}\text{-}\mathsf{CCA}$-security of $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ from having the $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ ciphertexts and prevent an adversary who can break the $\mathsf{IND}\text{-}\mathsf{CCA}$-security of ${\mathsf{\Pi }}^{\mathit{asym}}$ from directly seeing the message encrypted within. Importantly, along with the message, we encrypt a secret random value, $\delta$. Two hashes of $\delta$ are used as the randomness for the encapsulation of the KEM, $\mathcal{K}$, and the encryption under ${\mathsf{\Pi }}^{\mathit{asym}}$, respectively. This $\delta$ value is then later used during the decryption process to provide a method of ensuring that the ciphertext was well-formed. This ensures that the adversary cannot perform any re-encryption/encapsulation attacks on a ciphertext. We formally present QuAKe in Algorithms 7–9.

Algorithm 7$\mathsf{\Pi }.\mathsf{KeyGen}\left(1^n\right)$.

1: $(pk,sk)\leftarrow \${\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{KeyGen}\left(1^n\right)$

2: $(ek,dk)\leftarrow \$\mathcal{K}.\mathsf{KeyGen}\left(1^n\right)$

3: $p{k}^{\prime }\leftarrow (pk,ek)$

4: $s{k}^{\prime }\leftarrow (sk,dk)$

5: Return $(p{k}^{\prime },s{k}^{\prime })$

Algorithm 8$(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}}).\mathsf{Enc}(ek,m)$.

1: $\delta \leftarrow \${\{0,1\}}^l$

2: $(c_{KEM},k)\leftarrow \mathcal{K}.\mathsf{Encaps}(ek;{\mathsf{Hash}}_1\left(\delta \right))$

3: $c_{DEM}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k,m\parallel \delta )$

4: $c_{PKE}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,c_{DEM};{\mathsf{Hash}}_2\left(\delta \right))$

5: Return $(c_{KEM},c_{PKE})$

Algorithm 9$\mathsf{\Pi }.\mathsf{Dec}((sk,dk),(c_{KEM},c_{PKE}))$.

1: $c_{DEM}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Dec}(sk,c_{PKE})$

2: $k\leftarrow \mathcal{K}.\mathsf{Decaps}(dk,c_{KEM})$

3: $m\parallel \delta \leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Dec}(k,c_{DEM})$

4: if  $m\parallel \delta =\perp$  then

5:     Return ⊥

6: else

7:     if $(c_{KEM},-)\leftarrow \mathcal{K}.\mathsf{Encaps}(ek;{\mathsf{Hash}}_1\left(\delta \right))\wedge c_{PKE}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,c_{DEM};{\mathsf{Hash}}_2\left(\delta \right))$ then

8:         Return m

9:     else

10:         Return ⊥

11:     end if

12: end if

We first provide some insight into the construction of QuAKe. As mentioned, the use of $\delta$ is to deterministically randomize the encryption (encapsulation) of ${\mathsf{\Pi }}^{\mathit{asym}}$ ($\mathcal{K}$) and perform a check. This check is intended to guard against adversaries capable of total manipulation of either ${\mathsf{\Pi }}^{\mathit{asym}}$ or $\mathcal{K}$. For example, if an adversary is able to recover the key from any ciphertext of $\mathcal{K}$, as well as encapsulate any key they wish, the adversary may attempt to recover the key used in the challenge ciphertext, re-encapsulate to a different ciphertext, and then submit it to the decryption oracle. Without a check, the decryption oracle would then return the challenge message directly to the adversary. The case of ${\mathsf{\Pi }}^{\mathit{asym}}$ being completely broken by the adversary is analogous to the situation described above. Thus, without any check, there is no hope for security if one of ${\mathsf{\Pi }}^{\mathit{asym}}$ or $\mathcal{K}$ is broken by the adversary.

3.2. Security of QuAKe

In this section, we prove that QuAKe is a $(1,2)$-robust combiner with a tight security reduction for both $\mathsf{IND}\text{-}\mathsf{CCA}$ and ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security in the classical and quantum random oracle models, respectively.

3.2.1. $\mathsf{IND}\text{-}\mathsf{CCA}$-Security of QuAKe

We begin with the $\mathsf{IND}\text{-}\mathsf{CCA}$-security.

Theorem 2.

Let ${\mathsf{Hash}}_1:{\{0,1\}}^l\to {\{0,1\}}^{n_1}$ and ${\mathsf{Hash}}_2:{\{0,1\}}^l\to {\{0,1\}}^{n_2}$ be random oracles. Let $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ be an ${ϵ}_1$-correct KEM-DEM-based PKE and ${\mathsf{\Pi }}^{\mathit{asym}}$ be an ${ϵ}_2$-correct PKE. If either $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ is $\mathsf{IND}\text{-}\mathsf{CCA}$-secure or ${\mathsf{\Pi }}^{\mathit{asym}}$ is $\mathsf{IND}\text{-}\mathsf{CCA}$-secure PKE, then $\mathsf{\Pi }$, as described in Algorithms 7–9, is a $(1,2)$-robust combiner for $\mathsf{IND}\text{-}\mathsf{CCA}$-security in the random oracle model and is ϵ-correct, where $ϵ=max\{{ϵ}_1,{ϵ}_2\}$. More precisely, for any efficient classical adversary $\mathcal{A}$ that breaks the $\mathsf{IND}\text{-}\mathsf{CCA}$-security of $\mathsf{\Pi }$, there exist efficient adversaries ${\mathcal{B}}_1$, and ${\mathcal{B}}_2$ such that

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{\mathsf{IND}\text{-}\mathsf{CCA}}\le \frac{q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}}{2^l}+ϵ·q_{Dec}+min\{{\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right),{\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)\},$$

(8)

where the run times of all ${\mathcal{B}}_i$ are approximately equal to that of $\mathcal{A}$, $q_{Dec}$ is the number of decryption queries made by $\mathcal{A}$, and $q_{{\mathsf{Hash}}_i}$ is the number of queries made to the random oracle ${\mathsf{Hash}}_i$ by $\mathcal{A}$.

We begin with the correctness of $\mathsf{\Pi }$. It is straightforward to see that $\mathsf{\Pi }$ is perfectly correct if both $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ and ${\mathsf{\Pi }}^{\mathit{asym}}$ are perfectly correct. If $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ is perfectly correct, then the real encrypted message $m\parallel \delta$ in $(c_{KEM},c_{DEM})$ is always recovered when running the $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ part of the decryption. If ${\mathsf{\Pi }}^{\mathit{asym}}$ is perfectly correct, then $c_{PKE}$ always correctly decrypts to $c_{DEM}$. Finally, the deterministic re-encryption check is done; thus, an honestly generated ciphertext $\delta$ would have been used to generate the randomness for both $c_{KEM}$ and $c_{PKE}$ and so would pass the re-encryption check. Therefore, we have that $\mathsf{\Pi }$ is perfectly correct.

We now suppose that $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ and ${\mathsf{\Pi }}^{\mathit{asym}}$ are both not perfectly correct, but are ${ϵ}_1$- and ${ϵ}_2$-correct, respectively. Whenever a decryption query is made, both $\mathcal{K}.\mathsf{Decaps}$ and ${\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Dec}$ are performed. In the case of a decapsulation error occurring, a different symmetric key is recovered and used to decrypt some $c_{DEM}^{\prime }$ and obtain some $m^{\prime }\parallel {\delta }^{\prime }$. The case where $m^{\prime }\parallel {\delta }^{\prime }$ is equal to the actual message and randomness used is overwhelmingly unlikely. Therefore, either ⊥ is returned if either check fails or a different message is returned if the checks are passed. As decapsulation errors happen with probability ${ϵ}_1$, the probability of returning a different output instead of the true message is bounded above by probability ${ϵ}_1$.

The argument is analogous when considering the case of a decryption error occurring, and the probability of an output that is not the true message being returned is bounded above by ${ϵ}_2$. We thus conclude that $\mathsf{\Pi }$ is $ϵ$-correct, where $ϵ=max\{{ϵ}_1,{ϵ}_2\}$.

Proof. 

We now prove the security of $\mathsf{\Pi }$. First, we assume $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ is an $\mathsf{IND}\text{-}\mathsf{CCA}$-secure KEM-DEM encryption scheme.

$G_0$: Game 0, described in Algorithm 10, is the $\mathsf{IND}\text{-}\mathsf{CCA}$-security experiment for $\mathsf{\Pi }$ so,

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{\mathsf{IND}\text{-}\mathsf{CCA}}=\left|Pr[G_0\to 1]-\frac{1}{2}\right|.$$

(9)

Algorithm 10 Game 0 for the proof of Theorem 2, $G_0$.

1: $((pk,ek),(sk,dk))\leftarrow \$\mathsf{\Pi }.\mathsf{KeyGen}\left(1^n\right)$

2: $m_0,m_1,st\leftarrow {\mathcal{A}}^{\mathsf{Dec}((sk,dk),·),{\mathsf{Hash}}_1(·),{\mathsf{Hash}}_2(·)}(pk,ek)$

3: $b\leftarrow \$\{0,1\}$

4: ${\delta }^{*}\leftarrow \${\{0,1\}}^l$

5: $(c_{KEM}^{*},k^{*})\leftarrow \mathcal{K}.\mathsf{Encaps}(ek;{\mathsf{Hash}}_1\left({\delta }^{*}\right))$

6: $c_{DEM}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k^{*},m_b\parallel {\delta }^{*})$

7: $c_{PKE}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,c_{DEM}^{*};{\mathsf{Hash}}_2\left({\delta }^{*}\right))$

8: $b^{\prime }\leftarrow {\mathcal{A}}^{\mathsf{Dec}((sk,dk),·\ne (c_{KEM}^{*},c_{PKE}^{*})),{\mathsf{Hash}}_1(·),{\mathsf{Hash}}_2(·)}(pk,ek,st,(c_{KEM}^{*},c_{PKE}^{*}))$

9: Return $[b^{\prime }=b]$

$G_1$: For Game 1, outlined in Algorithm 11, we replace both ${\mathsf{Hash}}_1\left({\delta }^{*}\right)$ and ${\mathsf{Hash}}_2\left({\delta }^{*}\right)$ with $h^{\prime }$ and $h^{″}$, respectively, chosen uniformly at random from the ranges of ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$, so that if ${\mathsf{Hash}}_i$ is called on ${\delta }^{*}$, either $h^{\prime }$ or $h^{″}$ is returned instead of ${\mathsf{Hash}}_1\left({\delta }^{*}\right)$, or ${\mathsf{Hash}}_2\left({\delta }^{*}\right)$, respectively. This replacement is done consistently with the decryption algorithm so that if ${\mathsf{Hash}}_i$ is evaluated on ${\delta }^{*}$ during decryption, $h^{\prime }$ and $h^{″}$ are used to perform the checks. The probability of distinguishing between the first two games is upper bounded by the probability of $\mathcal{A}$ guessing ${\delta }^{*}$ and querying it. As ${\delta }^{*}$ was sampled uniformly at random, and as $\mathcal{A}$ has no access to ${\delta }^{*}$, unless they are able to completely invert both ${\mathsf{\Pi }}^{\mathit{asym}}$ and $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ since the decryption oracle never returns ${\delta }^{*}$, we have that

$$|Pr[G_0\to 1]-Pr[G_1\to 1]|\le \frac{q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}}{2^l},$$

(10)

where $q_{{\mathsf{Hash}}_i}$ is the number of queries $\mathcal{A}$ makes to ${\mathsf{Hash}}_i.$

Algorithm 11 Game 1 for the proof of Theorem 2, $G_1$.

1: $((pk,ek),(sk,dk))\leftarrow \$\mathsf{\Pi }.\mathsf{KeyGen}\left(1^n\right)$

2: $m_0,m_1,st\leftarrow {\mathcal{A}}^{\mathsf{Dec}((sk,dk),·),{\mathsf{Hash}}_1(·),{\mathsf{Hash}}_2(·)}(pk,ek)$

3: $b\leftarrow \$\{0,1\}$

4: ${\delta }^{*}\leftarrow \${\{0,1\}}^l$

5: $h^{\prime }\leftarrow \${\mathsf{Hash}}_1.Range$$//$ Using random coins in place of ${\mathsf{Hash}}_1\left({\delta }^{*}\right)$

6: $h^{″}\leftarrow \${\mathsf{Hash}}_2.Range$$//$ Using random coins in place of ${\mathsf{Hash}}_2\left({\delta }^{*}\right)$

7: $(c_{KEM}^{*},k^{*})\leftarrow \mathcal{K}.\mathsf{Encaps}(ek;h^{\prime })$

8: $c_{DEM}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k^{*},m_b\parallel {\delta }^{*})$

9: $c_{PKE}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,c_{DEM}^{*};h^{″})$

10: $b^{\prime }\leftarrow {\mathcal{A}}^{\mathsf{Dec}((sk,dk),·\ne (c_{KEM}^{*},c_{PKE}^{*})),{\mathsf{Hash}}_1(·),{\mathsf{Hash}}_2(·)}(pk,ek,st,(c_{KEM}^{*},c_{PKE}^{*}))$

11: Return $[b^{\prime }=b]$

We can now demonstrate that if $\mathcal{A}$ can win Game 1, then $\mathcal{A}$ can be used as an oracle algorithm to win the $\mathsf{IND}\text{-}\mathsf{CCA}$ experiment of $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$.

Claim: [1]

$$Pr[G_1\to 1]\le {\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right)+ϵ·q_{Dec}.$$

(11)

Proof. 

In the $\mathsf{IND}\text{-}\mathsf{CCA}$ experiment of $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$, ${\mathcal{B}}_1$ is first given the encapsulation key $ek$ of $\mathcal{K}$, then it runs ${\mathsf{\Pi }}^{\mathit{asym}}$ and generates $(pk,sk)$, and picks two random oracles ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$, then forwards $(pk,ek)$ to $\mathcal{A}$. Here, ${\mathcal{B}}_1$ is able to perfectly simulate the oracles $\mathcal{A}$ would have at this point, until eventually $\mathcal{A}$ terminates and outputs its two challenge messages $m_0$ and $m_1$. Then, ${\mathcal{B}}_1$ picks ${\delta }^{*}$ uniformly at random and submits $m_0\parallel {\delta }^{*}$ and $m_1\parallel {\delta }^{*}$ as its challenge messages. It then receives $(c_{KEM}^{*},c_{DEM}^{*})$ before picking $h^{″}$ uniformly at random and computing $c_{PKE}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{asym}}.\mathsf{Enc}(pk,c_{DEM}^{*};h^{″})$ and giving $(c_{KEM}^{*},c_{PKE}^{*})$ to $\mathcal{A}$.

To answer decryption queries for $\mathcal{A}$, when ${\mathcal{B}}_1$ receives $(c_{KEM},c_{PKE})$ it first decrypts $c_{PKE}$ itself by using $sk$, then uses its decryption oracle $(c_{KEM},c_{PKE})$, and finally performs the checks after receiving the decryption $m^{\prime }\parallel {\delta }^{\prime }$. Note that if $(c_{KEM},c_{DEM})=(c_{KEM}^{*},c_{DEM}^{*})$, then ${\mathcal{B}}_1$ cannot query its decryption oracle, but it does not need to do so, as in the real experiment such a query, provided a decryption error does not occur, would fail the re-encryption check. Thus, ${\mathcal{B}}_1$ will just perform a hash query to each of ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ before returning ⊥. As a result, the simulation is then perfect unless an error occurs in Game 1 during decryption and results in a message being returned. Eventually, $\mathcal{A}$ will submit a guess and ${\mathcal{B}}_1$ will submit the same guess.

Let E denote the event that $\mathcal{A}$ performs a query of the form, $(c_{KEM}^{*},c_{PKE})$ and $\mathsf{Dec}(sk,c_{PKE})=c_{DEM}^{*}$, that does not return ⊥ in Game 1 but does return ⊥ when simulated by ${\mathcal{B}}_1$.

We have that

$$Pr[G_1\to 1]=Pr[G_1\to 1|E]·Pr\left[E\right]+Pr[G_1\to 1|\neg E]·Pr[\neg E]$$

(12)

$$\le Pr\left[E\right]+Pr[G_1\to 1|\neg E]$$

(13)

First, note that $\neg E$ corresponds to ${\mathcal{B}}_1$’s simulation of $\mathcal{A}$’s decryption oracle being perfect, that is ${\mathcal{B}}_1$’s answer to queries of the form $(c_{KEM}^{*},c_{PKE})$ and $\mathsf{Dec}(sk,c_{PKE})=c_{DEM}^{*}$ agree with $\mathcal{A}$’s decryption oracle. Thus, we have

$$Pr[G_1\to 1|\neg E]\le {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right).$$

(14)

We now bound from above $Pr\left[E\right]$. As described, if decryption was performed correctly, the oracle would return ⊥ as the query would fail the re-encryption check; thus, E could only have occurred if a decryption error had taken place. Since QuAKe is $ϵ$-correct we apply a uniform bound across all decryption queries and conclude that $Pr\left[E\right]\le ϵ·q_{Dec}.$

Thus, we have

$$Pr[G_1\to 1]\le {\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right)+ϵ·q_{Dec}.$$

   □

As a result, by combing the inequalities above, we have

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left(\mathcal{A}\right)\le {\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right)+ϵ·q_{Dec}+\frac{q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}}{2^l}.$$

(15)

   □

We now consider the case where ${\mathsf{\Pi }}^{\mathit{asym}}$ is an $\mathsf{IND}\text{-}\mathsf{CCA}$ PKE.

Proof. 

$G_0$: Game 0, as described in Algorithm 10, is the $\mathsf{IND}\text{-}\mathsf{CCA}$-security experiment for $\mathsf{\Pi }$ so,

$${\mathsf{Adv}}_{kdp}^{\mathsf{IND}\text{-}\mathsf{CCA}}=\left|Pr[G_0\to 1]-\frac{1}{2}\right|.$$

(16)

$G_1$: For Game 1, we perform the same game hop as before in Algorithm 11, and replace both ${\mathsf{Hash}}_1\left({\delta }^{*}\right)$ and ${\mathsf{Hash}}_2\left({\delta }^{*}\right)$ with $h^{\prime }$ and $h^{″}$, chosen independently and uniformly at random from the ranges of ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$. This change is done consistently with the random oracles and the decryption oracle so that if ${\delta }^{*}$ is queried during decryption, $h^{\prime }$ and $h^{″}$ are used for the check. By the same argument as above we have that the probability that $\mathcal{A}$ distinguishes between these games is

$$|Pr[G_0\to 1]-Pr[G_1\to 1]|\le \frac{q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}}{2^l},$$

(17)

where $q_{{\mathsf{Hash}}_i}$ is the number of queries $\mathcal{A}$ makes to ${\mathsf{Hash}}_i.$

We are now able to show that if $\mathcal{A}$ can win Game 1, then $\mathcal{A}$ can be used as an oracle algorithm to win the $\mathsf{IND}\text{-}\mathsf{CCA}$ experiment of ${\mathsf{\Pi }}^{\mathit{asym}}$.

Claim: [2]

$$Pr[G_1\to 1]\le {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)+ϵ·q_{Dec}.$$

(18)

Proof. 

Suppose that $\mathcal{A}$ can win Game 1 in the classical setting with non-negligible probability, then it can be used as an oracle algorithm to break the $\mathsf{IND}\text{-}\mathsf{CCA}$-security of ${\mathsf{\Pi }}^{\mathit{asym}}$ as follows. Once ${\mathcal{B}}_2$ is given $pk$ by the $\mathsf{IND}\text{-}\mathsf{CCA}$ challenger it runs $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ to generate the key pair $(ek,dk)$, then it selects ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ uniformly at random, and finally forwards the $(pk,ek)$ to $\mathcal{A}$. At this stage, ${\mathcal{B}}_2$ can perfectly act as a random oracle to $\mathcal{A}$ and uses its decryption oracle for ${\mathsf{\Pi }}^{\mathit{asym}}$ to act as a decryption oracle for $\mathsf{\Pi }$. Eventually, $\mathcal{A}$ terminates and outputs challenge messages $m_0$ and $m_1$ to ${\mathcal{B}}_2$ who then selects ${\delta }^{*}$ and $h^{\prime }$ uniformly at random and performs the following computations:

$$(c_{KEM}^{*},k^{*})\leftarrow \mathcal{K}.\mathsf{Encaps}(ek;h^{\prime }),$$

(19)

$$c_{DEM,0}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k,m_0\parallel {\delta }^{*}),$$

(20)

$$c_{DEM,1}^{*}\leftarrow {\mathsf{\Pi }}^{\mathit{sym}}.\mathsf{Enc}(k,m_1\parallel {\delta }^{*}).$$

(21)

Then, ${\mathcal{B}}_2$ submits $c_{DEM,0}^{*},c_{DEM,1}^{*}$ as its challenge messages. Next, ${\mathcal{B}}_2$ then receives $c_{PKE}^{*}$ and forwards $(c_{KEM}^{*},c_{PKE}^{*})$ to $\mathcal{A}$ and acts as the decryption oracle. We note that there are special cases of decryption queries that ${\mathcal{B}}_2$ will not fully perform, but can answer.

• $(c,c_{PKE}^{*})$: ${\mathcal{B}}_2$ cannot query $c_{PKE}^{*}$ to its own decryption oracle. However, ${\mathcal{B}}_2$ answers the query as follows: use $dk$ to decapsulate c; if the result is $k^{*}$, query ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ on r, a uniform random value, then return ⊥; otherwise, simply return ⊥ without querying the random oracles. In the first case, the real $\mathsf{IND}\text{-}\mathsf{CCA}$ experiment would reject, as the re-encapsulation check would fail. While in the second case, the symmetric decryption algorithm would reject as $c_{DEM,b}^{*}$ was encrypted under $k^{*}$ and the key given was different.
• $(c_{KEM}^{*},c_{PKE})\wedge \mathsf{Dec}(sk,c_{PKE})=c_{DEM,b}^{*}$: ${\mathcal{B}}_2$ will always return ⊥ and query ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ on r, a uniform random value. In a real experiment, such a query would be rejected as it would fail the re-encryption check.

For all other queries, ${\mathcal{B}}_2$ is able to perform decryption queries perfectly matching $\mathcal{A}$’s oracles.

Eventually, $\mathcal{A}$ terminates and outputs a guess, which ${\mathcal{B}}_2$ matches.

Let F denote the event that $\mathcal{A}$ performs a special case decryption query that does not return ⊥ in Game 1 but returns ⊥ when simulated by ${\mathcal{B}}_2$.

We have that

$$Pr[G_1\to 1]=Pr[G_1\to 1|F]·Pr\left[F\right]+Pr[G_1\to 1|\neg E]·Pr[\neg F]$$

(22)

$$\le Pr\left[F\right]+Pr[G_1\to 1|\neg F].$$

(23)

First, note that $\neg F$ corresponds to ${\mathcal{B}}_2$’s simulation of $\mathcal{A}$’s decryption oracle being perfect, as it was able to correctly answer all special case decryption queries. Thus, we have

$$Pr[G_1\to 1|\neg F]\le {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right).$$

(24)

We now bound from above $Pr\left[F\right]$. As outlined above in how ${\mathcal{B}}_2$ answers special decryption cases, if decryption was performed correctly, both cases would return ⊥, thus F could only have occurred if a decryption error had taken place. Since QuAKe is $ϵ$-correct we apply a uniform bound across all decryption queries and conclude that $Pr\left[F\right]\le ϵ·q_{Dec}.$

Thus, we have

$$Pr[G_1\to 1]\le {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)+ϵ·q_{Dec}.$$

   □

Finally, we can conclude if ${\mathsf{\Pi }}^{\mathit{asym}}$ is in an $\mathsf{IND}\text{-}\mathsf{CCA}$ PKE, then

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{\mathsf{IND}\text{-}\mathsf{CCA}}\le {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)+ϵ·q_{Dec}+\frac{q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}}{2^l}.$$

(25)

   □

3.2.2. ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-Security of QuAKe

Next, we prove the ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security of QuAKe.

Theorem 3.

Let ${\mathsf{Hash}}_1:{\{0,1\}}^l\to {\{0,1\}}^{n_1}$ and ${\mathsf{Hash}}_2:{\{0,1\}}^l\to {\{0,1\}}^{n_2}$ be quantum random oracles. Let $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ be an ${ϵ}_1$-correct KEM-DEM based PKE and ${\mathsf{\Pi }}^{\mathit{asym}}$ be an ${ϵ}_2$-correct PKE. If either $(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})$ is ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-secure or ${\mathsf{\Pi }}^{\mathit{asym}}$ is ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-secure, then $\mathsf{\Pi }$, as described in Algorithms 7–9, is a $(1,2)$-robust combiner for ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security in the quantum random oracle model and is ϵ-correct, where $ϵ=max\{{ϵ}_1,{ϵ}_2\}$. More precisely, for any efficient quantum adversary $\mathcal{A}$ that breaks the ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security of $\mathsf{\Pi }$, there exists efficient adversaries ${\mathcal{B}}_1$ and ${\mathcal{B}}_2$ such that

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\le \frac{2(q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}+q_{\mathsf{Dec}})}{\sqrt{2^l}}+ϵ·q_{Dec}+min\left\{\begin{array}{c}{\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right)\hfill \\ {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)\hfill \end{array}\right..$$

(26)

where the run times of all ${\mathcal{B}}_i$ are approximately equal to that of $\mathcal{A}$, and the hash queries performed by each ${\mathcal{B}}_i$ are equal to $\mathcal{A}$.

Proof. 

We will outline the proof of ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security of QuAKe. It is virtually identical to that of Theorem 2, except ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ are replaced with quantum random oracles, $\mid {\mathsf{Hash}}_1\rangle$ and $\mid {\mathsf{Hash}}_2\rangle$, the simulator algorithms use $2q^{\prime }$-wise independent functions, where $q^{\prime }$ is the number of queries the adversary makes in the reduction, and the adversaries are quantum. The primary difference is the first game hop to $G_1$, as described in Algorithm 11 in both halves of the proof. In the classical setting, we employ a simple replacement of ${\mathsf{Hash}}_i\left(\delta \right)$ with $h^{\prime }$ or $h^{″}$. However, such a replacement does not work in the quantum random oracle model. This is due to the inability of the challenger to read the oracle queries and perform the replacement of ${\mathsf{Hash}}_1\left(\delta \right)$ with $h^{\prime }$ and ${\mathsf{Hash}}_2\left(\delta \right)$ with $h^{″}$ in the quantum random oracle model as a result of superposition access to the oracles. Instead, we invoke the O2H Lemma 1 to replace the hashes with random values and otherwise continue in the same manner. We provide a description of the O2H simulator $\mathcal{B}$ below in Algorithm 12, where $\mathcal{A}$ is the ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$ adversary from the security experiment. After this replacement, the proof continues in the same fashion as in Theorem 2.

In Game 1, we reprogram both ${\mathsf{Hash}}_1$ and ${\mathsf{Hash}}_2$ on ${\delta }^{*}$; thus, to invoke the O2H Lemma we set $S:=\left\{\delta \right\}$, $H:=\mid {\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\rangle$, where ${\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\left(a\right):=({\mathsf{Hash}}_1\left(a\right),{\mathsf{Hash}}_2\left(a\right))$, G is H except reprogrammed such that when queried on $\delta$, $(h^{\prime },h^{″})$ is returned, and $z=({\delta }^{*},({\mathsf{Hash}}_1\left({\delta }^{*}\right),{\mathsf{Hash}}_2\left({\delta }^{*}\right))$.

Algorithm 12 O2H Simulator algorithm, ${\mathcal{B}}^{\mid {\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\rangle }\left({\delta }^{*}\right)$.

1: $i\leftarrow \$\{1,...,q^{\prime }\}$

2: run ${\mathcal{A}}^{\mid {\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\rangle }({\delta }^{*},({\mathsf{Hash}}_1\left({\delta }^{*}\right),{\mathsf{Hash}}_2\left({\delta }^{*}\right))$ until the ith query.

3: if $i>$ the number of queries made to $\mid {\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\rangle$ then

4:     Return ⊥

5: else Measure the query $\widehat{\delta }$

6:     return $\left[[\widehat{\delta }={\delta }^{*}]\right]$

7: end if

We then have that $P_{left}$, as in the O2H Lemma, describes Game 0 for $\mathcal{A}$ as it is running with the original, untampered oracle H. While $P_{right}$ describes $\mathcal{A}$ running with the reprogrammed oracle G, which returns $(h^{\prime },h^{″})$ when queried on ${\delta }^{*}$. In both cases, $\mathcal{A}$ is running on input $z=({\delta }^{*},({\mathsf{Hash}}_1\left({\delta }^{*}\right),{\mathsf{Hash}}_2\left({\delta }^{*}\right))$.

Finally, $P_{guess}$ is then described in Algorithm 12. Note, as ${\delta }^{*}$ was chosen uniformly at random from ${\{0,1\}}^l$, we have $P_{guess}=\frac{1}{2^l}$. We also note that $\mathcal{B}$ makes at most $q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}+q_{\mathsf{Dec}}$ queries to its oracle $\mid {\mathsf{Hash}}_1\times {\mathsf{Hash}}_2\rangle$ to answer $\mathcal{A}$’s queries, and so we have that $q^{\prime }=q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}+q_{\mathsf{Dec}}$. Thus, by the O2H Lemma, we have that

$$|Pr[G_0\to 1]-Pr[G_1\to 1]|\le \frac{2(q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}+q_{\mathsf{Dec}})}{\sqrt{2^l}}.$$

(27)

As mentioned before, from here, the proof proceeds in the same fashion as in Theorem 2, and we can then conclude

$${\mathsf{Adv}}_{\mathsf{\Pi }}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\le \frac{2(q_{{\mathsf{Hash}}_1}+q_{{\mathsf{Hash}}_2}+q_{\mathsf{Dec}})}{\sqrt{2^l}}+ϵ·q_{Dec}+min\left\{\begin{array}{c}{\mathsf{Adv}}_{(\mathcal{K},{\mathsf{\Pi }}^{\mathit{sym}})}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_1\right)\hfill \\ {\mathsf{Adv}}_{{\mathsf{\Pi }}^{\mathit{asym}}}^{{\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}}\left({\mathcal{B}}_2\right)\hfill \end{array}\right..$$

   □

4. Comparisons

We next include a brief discussion on the previous results on combiners, beginning with PKE combiners and then KEM combiners.

4.1. PKE Combiners

Asmuth and Blakely [5] proposed what would retroactively become one of the first PKE combiner with the so-called “XOR-Input” combiner, defined as

$$c=({\mathsf{\Pi }}_1.\mathsf{Enc}(p{k}_1,r),{\mathsf{\Pi }}_2.\mathsf{Enc}(p{k}_2,m\oplus r)),$$

(28)

where r is a uniformly random value. However, Harnik et al. would later prove that such a combiner is not robust for $\mathsf{IND}\text{-}\mathsf{CCA}$-security, but rather is only robust for weaker notions, such as $\mathsf{IND}\text{-}\mathsf{CPA}$ and $\mathsf{IND}\text{-}\mathsf{CCA}1$-security [6]. Additionally, Harnik et al. proved that the nested, or cascade, encryption combiner is also not robust for $\mathsf{IND}\text{-}\mathsf{CCA}$-security.

Hohenberger et al. [8] proposed a combiner which does attain $\mathsf{IND}\text{-}\mathsf{CCA}$-security but requires three encryption schemes, each of which are required to be secure according to three different security notions, meaning it is, in essence, a $(3,3)$-robust combiner. This undermines the appeal of using combiners in that the resulting algorithm is secure without full trust in the security of all inputs. Furthermore, there does not exist any result on the necessary and, more importantly, sufficient conditions to reach ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security. Thus, the viability of this combiner for classical and quantum schemes is unclear.

4.2. KEM Combiners

Giacon et al. provided several $\mathsf{IND}\text{-}\mathsf{CCA}$-robust KEM combiners with different constructions assuming either the standard, random oracle, or ideal cipher models [10]. In this work, various key-mixing functions, or core functions, as Giacon et al. termed them, are used to combine the different keys and ciphertexts to produce a new secure key. Moreover, the authors establish a sufficient condition for the core function, such that the respective combiners retain $\mathsf{IND}\text{-}\mathsf{CCA}$-security from any one of the input KEMs. This condition is a novel security notion called split-key pseudorandomness. Informally, split-key pseudorandomness states that so long as any of the input keys are uniformly distributed, then the resulting evaluation of the core function will also be uniformly distributed. The specific core functions used in this work include: evaluating a pseudorandom function (PRF) on an individual key and all ciphertexts before XORing all evaluations together, using a random oracle on the ciphertexts and the keys or in a nested series of keyed permutations, and finally evaluating a PRF on the ciphertexts and a nested series of ideal cipher evaluations.

Bindel et al. provided further constructions of KEM combiners with the further consideration of adversaries with different levels of quantum capabilities, so-called ${\mathsf{X}}^{\mathsf{y}}\mathsf{Z}$ adversaries [4]. The results of this approach were three KEM combiners in the same vein as Giacon et al.’s core functions which combine the different keys to produce the new key while also being secure against both classical and quantum adversaries. Specifically, the combiners constructed are the so-called “XOR-then MAC” combiners where the keys are split to produce an ephemeral key and MAC key to be computed over the ciphertexts and two combiners using a dual PRF as well as traditional PRFs.

Ultimately, the most successful previous works are those which present constructions of hybrid secure robust KEM combiners, that hybridize PKEs according to Theorem 1 and Corollary 1. However, this is done utilizing a similar approach, namely generating multiple keys and using core functions to sufficiently randomize them and creating a single symmetric key.

In comparison, our construction relies on fewer and relatively traditional assumptions of cryptographic primitives than the previous constructions. However, our construction does have the drawback of worse performance during decryption due to the re-encryption and re-encapsulation checks performed. Finally, most of the previous constructions rely on the secure KEM component having perfect correctness. This limits which quantum-resistant algorithms can be used as inputs due to the correctness error present in many lattice-based schemes. Our construction does not have this limitation.

5. Conclusions

Hybrid cryptographic algorithms, which combine both classical and quantum-resistant primitives, offer an appealing solution to the upcoming problems associated with the transitioning of the cryptographic infrastructure. Such algorithms provide quantum-resistance without the risk of losing current-day security assurances and satisfy existing standards. While there have been earlier work on the theory of hybrid cryptography, there have not been any results on direct constructions of hybrid PKEs or hybrid combiners for PKEs. The more common approach has been to develop KEM combiners and then convert the resulting KEM into a PKE.

In this work, we furthered the theory of hybrid cryptography by proposing a new provably secure $(1,2)$-robust combiner, QuAKe, with tight reduction for both $\mathsf{IND}\text{-}\mathsf{CCA}$-security in the random oracle model, and ${\mathsf{Q}}^{\mathsf{c}}\mathsf{Q}\text{-}\mathsf{IND}\text{-}\mathsf{CCA}$-security in the quantum random oracle model. Our combiner built from the KEM-DEM paradigm first proposed by Cramer and Shoup [14] and augmented the paradigm to directly construct a new, fully secure PKE. Moreover, our construction was built with fewer components and security assumptions when compared with previous results, as well as not being limited to schemes with perfect decryption correctness.