Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Journal articles
  4. On The Multi-target Security of Post-Quantum Key Encapsulation Mechanisms
 
research article

On The Multi-target Security of Post-Quantum Key Encapsulation Mechanisms

Glabush, Lewis  
•
Hövelmanns, Kathrin
•
Stebila, Douglas
May 4, 2026
IACR Communications in Cryptology

Practical deployments of key encapsulation mechanisms (KEMs) may entail large servers each using their public keys to communicate with potentially millions of clients simultaneously. While the standard IND-CCA security definition for KEMs considers only a single challenge public key and single challenge ciphertext, it can be relevant to consider multi-target scenarios where the adversary aims to break one of many challenge ciphertexts, for one of many challenge public keys. Many post-quantum KEMs have been built by applying the Fujisaki-Okamoto (FO) transform to a public key encryption (PKE) scheme. Although the FO transform incurs only a few bits of security loss for the standard, single-challenge IND-CCA property, this does not hold in the multi-target setting. Attacks have been identified against standards-track FO-based KEMs with 128-bit message spaces (FrodoKEM-640 and HQC-128) which become feasible if the adversary is given many challenge ciphertexts (say, 2^64). These attacks exploit the deterministic encryption induced by the FO transform which allows the IND-CCA experiment to be reduced to a search problem on the message space, which in some cases may not be large enough to avoid collisions between pre-computation and challenge values. A cost effective way to amplify the hardness of this search problem is to add a random but public salt during encapsulation. While revised versions of FrodoKEM and HQC have used salts, there has been no proof showing that salting provides multi-ciphertext security. In this work, we formally analyze a salted variant of the Fujisaki-Okamoto transform, in the classical and quantum random oracle model (ROM); for the classical ROM, we show that multi-target IND-CCA security of the resulting KEM tightly reduces to the multi-target IND-CPA security of the underlying PKE. Our results imply that, for FrodoKEM and HQC at the 128-bit security level, replacing the FO transform with the salted variant can recover 62 bits of multi-target security, at the cost of a very small overhead increase.

  • Details
  • Metrics
Type
research article
DOI
10.62056/a63zl83y6
Author(s)
Glabush, Lewis  

École Polytechnique Fédérale de Lausanne

Hövelmanns, Kathrin
Stebila, Douglas
Date Issued

2026-05-04

Publisher

International Association for Cryptologic Research

Published in
IACR Communications in Cryptology
Volume

3

Issue

1

Article Number

cc3-1-50

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
LASEC  
FunderFunding(s)Grant NumberGrant URL

Dutch Research Council

VI.Veni.222.397

Natural Sciences and Engineering Research Council of Canada

RGPIN-2022-03187

Natural Sciences and Engineering Research Council of Canada

ALLRP 578463-22

Available on Infoscience
May 6, 2026
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/263335
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés