Scalable Ciphertext Compression Techniques for Post-quantum KEMs and Their Applications

Abstract

A multi-recipient key encapsulation mechanism, or mKEM, provides a scalable solution to securely communicating to a large group, and o↵ers savings in both bandwidth and computational cost compared to the trivial solution of communicating with each member individually. All prior works on mKEM are only limited to classical assumptions and, although some generic constructions are known, they all require specific properties that are not shared by most post-quantum schemes. In this work, we first provide a simple and e cient generic construction of mKEM that can be instantiated from versatile assumptions, including post-quantum ones. We then study these mKEM instantiations at a practical level using 8 post-quantum KEMs (which are lattice and isogeny-based NIST candidates), and CSIDH, and show that compared to the trivial solution, our mKEM o↵ers savings of at least one order of magnitude in the bandwidth, and make encryption time shorter by a factor ranging from 1.92 to 35. Additionally, we show that by combining mKEM with the TreeKEM protocol used by MLS -an IETF draft for secure group messaging -we obtain significant bandwidth savings.

Towards Post-Quantum Security for Signal’s X3DH Handshake

“…The notion of merged KEMs [32] aims to optimize bandwidth for public ratchets in the Signal protocol; our work and the notion of split KEMs instead is concerned with the initial key agreement with contributions from both parties. In their notion of multi-recipient KEMs, Katsumata et al [45] also decompose the encapsulation process, though without allowing a secret input of the sender to enter encapsulation as in our split KEM notion.…”

A Concrete Treatment of Efficient Continuous Group Key Agreement via Multi-Recipient PKEs

“…We introduce the notion of a committing mPKE, or CmPKE. First, a (decomposable) multi-recipient PKE (mPKE) [43] takes as input a message M and a list of N encryption keys, and outputs a multi-recipient ciphertext (ct 0 ,…”

“…We show how to build a CmPKE from an mPKE [43] and a key-committing SKE [2,32,33,37], which can itself be built using standard symmetric primitives [2]. Compared to the base mPKE, the overhead is minimal: ct i = ct i , and T is formed of ct 0 and a term of size 2κ bits, which is no larger than a hash digest.…”

“…existing PKEs based on the post-quantum problems LWE, LWR, SIDH and CSIDH were recently adapted to the mPKE setting in [43]. These mPKEs achieve ratios | ct i |/|ct| between 1/5 and 1/169, which could potentially translate into inversely proportional bandwidth savings.…”

“…These mPKEs achieve ratios | ct i |/|ct| between 1/5 and 1/169, which could potentially translate into inversely proportional bandwidth savings. The work of [43] has two shortcomings; (a) their mPKEs are direct transpositions of existing PKEs, which were not necessarily designed to minimize | ct i |, and (b) it does not study the concrete impact of the mPKE setting on cryptanalysis. We address these two shortcomings via a two-pronged approach.…”