Hybrid encryption in correlated randomness model and KEM combiners

Abstract

Hybrid encryption (HE) is an efficient public key encryption system for messages of unrestricted length. Like public key encryption, it does not require the establishment of a shared key, while benefiting from the efficiency and flexibility of symmetric key encryption systems in encrypting messages without length restrictions. An HE system consists of a public key component, called key encapsulation mechanism (KEM), and a symmetric key component, called data encapsulation mechanism (DEM). In HE encryption, KEM is used to generate a random key that will be used by DEM algorithm to encrypt the message, and they generate a ciphertext. HE decryption uses the ciphertext to first recover the random key, and then use it to decrypt the message. The KEM/DEM composition theorem proves that if the KEM and DEM components satisfy certain security properties, then the resulting HE will satisfy the well-established security notions of public key encryption systems. KEM/DEM paradigm has been widely studied and used for securing communication over the Internet.

We motivate and introduce HE in correlated randomness setting where, instead of public and private key, the HE encryption and decryption algorithms have their respective private correlated random values that are partially leaked to the adversary. We define two types of KEMs, iKEM with information theoretic security and cKEM with computational security, and prove a composition theorem for each of these KEMs and a DEM with computational security. This results in efficient and secure HEs with proved computational CPA (Chosen Plaintext Attack) and CCA (Chosen Ciphertext Attack) security, and in the case of iKEM, without relying on specific computational hardness assumptions beyond general ones, such as the existence of one-way hash functions, or practical assumptions, such as the security of AES. We construct two iKEMs, based on an information theoretic secure one-message key agreement protocol, and prove their security against passive and active adversaries, respectively. The iKEMs are used to construct two efficient quantum-resistant HEs, with post-quantum security, using an AES based DEM.

To combine the new KEM/DEM paradigm of HE with the traditional public key based paradigm, we extend KEM combiners to combine a public-key KEM with an iKEM such that the resulting KEM is as secure as any of the two component KEMs. We discuss our results and their applications, and outline directions for future work.