Indistinguishability under adaptive chosen-ciphertext attack secure double-NTRU-based key encapsulation mechanism

Introduction

Public-key cryptosystems (PKC) are commonly used for essential purposes such as key sharing, authentication, and data encryption. Today, Diffie-Hellman (DH) key exchange (KE) (Diffie & Hellman, 1976) and RSA encryption/key encapsulation mechanism (KEM) (Rivest, Shamir & Adleman, 1978) are some of the widely used PKC. Shor’s algorithm (Shor, 1994) proposed a polynomial-time solution to some computationally hard problems that guarantee the security assumptions of traditional PKC. It provides a solution to integer factorization (IF) and discrete logarithm problems (DLP) in polynomial time on a sufficiently large quantum computer. The requirement for constructing post-quantum secure PKC has emerged. While it will take time to build large-scale quantum computers, many initiatives exist to obtain post-quantum secure communication. In 2016, NIST started a standardization process (National Institute of Standards and Technology (NIST), 2023) to determine the standard PKC for the post-quantum era. One of the post-quantum secure cryptosystem families is the lattice-based constructions that provides worst-case assumptions, strong security guarantees, and relatively efficient applications. The lattice-based Number Theory Research Unit (NTRU) encryption scheme was proposed by Hoffstein-Pipher-Silverman (Hoffstein, Pipher & Silverman, 1998). The security of the NTRU is based on the shortest vector problem. It provides relatively short and easy to construct keys and needs low memory with a high-speed guarantee. Many NTRU-like protocols have been proposed for today and post-quantum secure communication. Some current literature based on the NTRU is examined as follows.

The non-commutative ring structure was used in the MaTRU cryptosystem (Coglianese & Goi, 2005). The linear transformation of MaTRU provided significant speed improvements compared to the NTRU. The comparison analysis shows that MaTRU has a larger public key size than the NTRU, while the secret key size is smaller. In Stehlé & Steinfeld (2011), the secret polynomial distribution of the NTRU was changed. The obtained construction provided efficient and flexible cryptographic structures. The hardness assumption of the proposed scheme was based on the ring learning with errors (RLWE) problem. The chosen-plaintext attack (CPA) resistance of this protocol was also presented. In 2013, ETRU encryption scheme was proposed by changing the algebraic structure of the NTRU (Jarvis & Nevins, 2015). The ring structure of ETRU was obtained by using Eisenstein integers. It is faster than the NTRU since it has smaller key sizes. The security analysis showed that ETRU is secure against chosen ciphertext attacks (CCA). In Karbasi & Atani (2015), ILNTRU was constructed as a modified version of ETRU. The hardness assumption was based on the ring short integer solution (RSIS) and RLWE problems. It also provided indistinguishability under CPA (IND-CPA) resistance. In 2018, IND-CPA secure D-NTRU scheme was proposed in Wang, Lei & Hu (2018). The security of the D-NTRU was explained based on the one-way assumption of the double-encrypted NTRU version. According to the comparison results, the D-NTRU was asymptotically faster than the NTRU. Many NTRU-based cryptosystems were also proposed in the NIST’s standardization project and none was selected as a standard (National Institute of Standards and Technology (NIST), 2023). One of the NTRU-based cryptosystems is Chen et al. (2022). It was designed as a KEM that guarantees IND-CCA2 security in the random oracle model (ROM). Applying the general transformation to the deterministic PKC provided a simple, fast, and compact structure.

In the literature, two methods were generally used to construct IND-CCA2 secure KEM: NAEP transformation (Howgrave-Graham et al., 2003) and Dent construction (Dent, 2003). A pseudo-trapdoor one-way function-based padding mechanism of NAEP provided the IND-CCA2 security (Howgrave-Graham et al., 2003). Dent’s generic KEM construction contains special hash functions to obtain key derivation and masking data based on a one-way CPA secure encryption scheme (Dent, 2003). In this article, we follow the idea of Dent to obtain IND-CCA2 secure KEM as it is simple and does not require any padding mechanism. In addition, the D-NTRU encryption (Wang, Lei & Hu, 2018) was constructed using one-way hash functions that provide one-wayness against CPA security. So, the adaptation of Dent’s approach will be more suitable and simple than NAEP for producing the D-NTRU-based IND-CCA2 secure KEM.

Mathematical background

The notations are summarized in Table 1.

In 2018, an NTRU variant double NTRU (D-NTRU) scheme was proposed in Wang, Lei & Hu (2018). To explain the main properties of the D-NTRU, the composite NTRU (C-NTRU) was also defined. The hardness assumptions of the C-NTRU and the D-NTRU were based on the traditional NTRU scheme. Since this article aims to obtain the IND-CCA2 version of the D-NTRU, the main properties of the C-NTRU and the D-NTRU are recalled in the following.

In Wang, Lei & Hu (2018), the C-NTRU was defined to explain the idea of the D-NTRU scheme. Let $p=3$, $q_2\in {\mathbb{Z}}^{+}$, N, and $q_1\approx q$ be prime numbers such that gcd $(q_1,q_2)=$ gcd $(q_1,p)=1$. The C-NTRU scheme is recalled in Fig. 1.

In Fig. 1, the composite integers are used as moduli to obtain the public key. In step 7, $h[i]\mathrm{m}\mathrm{o}\mathrm{d}{q}_1{q}_2$ is computed with the Chinese remainder theorem (CRT), where $h[i]\equiv h_1[i]\mathrm{m}\mathrm{o}\mathrm{d}{q}_1$ and $h[i]\equiv h_2[i]\mathrm{m}\mathrm{o}\mathrm{d}{q}_2$ for $i\in [N]$. By following the steps of the key generation function, $h$ and $(f,f_p^{-1})$ are generated as the public and secret keys of the C-NTRU, respectively. The ciphertext of the C-NTRU $c=F_c(\varphi ,m)=\varphi \otimes h+m\mathrm{m}\mathrm{o}\mathrm{d}{q}_1{q}_2$ is obtained by running the encryption procedure with input message $m\in R_p$. In the decryption phase, $c$ is decrypted to $m$ with the help of the private key $f_p^{-1}$.

Based on the C-NTRU encryption, the C-NTRU one-way problem was defined in Wang, Lei & Hu (2018).

The C-NTRU one-way problem was obtained by following the NTRU one-way problem (Wang, Lei & Hu, 2018).

The hardness assumption of the NTRU one-way problem is recalled in Definition 3.

The relation between the NTRU and the C-NTRU one-way problems is given by Fact 1.

The C-NTRU ciphertext distribution problem is described in Definition 4.

The relationship between the C-NTRU one-way problem and the ciphertext distribution is summarized Fact 2.

By showing reductions to the C-NTRU properties, the D-NTRU scheme was also constructed to obtain more efficient the NTRU-based public-key encryption (Wang, Lei & Hu, 2018). In the proposed scheme, double encryption is provided with the usage of twin primes. The main structure of the D-NTRU is remembered in Definition 5.

The proposed D-NTRU was designed as a double version of the NTRU that provide one-time pad encryption. The ct component $c_1$ allows some parameters, such as $r_1$ and $r_2$, to be shared and recovered, while $c_2$ provides one-time pad-like encryption. The D-NTRU encryption scheme using $q_1$ and $q_2$ twin primes is given in Fig. 2.

The relation between secret polynomials and components of the D-NTRU is recalled in Corollary 1.

The conditions to prevent possible errors during the decryption phase of the D-NTRU are explained with Theorem 1.

Based on Theorem 1, the relation between the ciphertext and the parameters of the D-NTRU is explained with Theorem 2. Please see the detailed proof of Theorem 2 in Wang, Lei & Hu (2018).

The invalid ciphertext of the D-NTRU is examined in Theorem 3. Please see the detailed proof of Theorem 3 in Wang, Lei & Hu (2018).

The distribution problem of the D-NTRU is recalled in Definition 6.

The relation between Definitions 4 and 6 is summarized with Fact 3.

The one-way property of the D-NTRU scheme is explained in Corollary 2.

The main properties of the D-NTRU encryption scheme are defined by explaining its relationship with the C-NTRU and the NTRU. In this section, the relations between hard problems and their main properties are expressed to show the one-wayness property of the D-NTRU encryption. Based on Corollary 2 and Dent’s KEM construction (Dent, 2003), the proposed KEM is explained in Section 3.

Proposed scheme

In this section, the proposed D-NTRU based IND-CCA2 secure KEM is detailed. Due to the one-way structure of the D-NTRU encryption function, to obtain IND-CCA2 security, Dent’s one-way KEM construction (Dent, 2003) is added. The basic idea of obtaining the D-NTRU-based IND-CCA2 KEM is based on the modified D-NTRU encryption and Dent’s KEM components. The proposed IND-CCA2 secure D-NTRU-based KEM scheme is given in Fig. 3.

In Fig. 3, the public and secret keys are generated using the key generation procedure of Algorithm 3. To construct IND-CCA2 secure KEM, Dent’s KEM design idea, based on a one-way function, is used. In the encapsulation procedure of Algorithm 3, the ct components of Algorithm 2 are reevaluated in the following way.

• $c_1=r_1\otimes h_1+r_2\mathrm{m}\mathrm{o}\mathrm{d}{q}_1$ is modified as $c_1=(r_1+r_2)\otimes h_1+(p\otimes g+1)\otimes r_2\mathrm{m}\mathrm{o}\mathrm{d}{q}_1$ to prevent a IND-CCA2 based attack that is explained in Remark 3.

• $c_2=r_1\otimes h_2+r_2+M\mathrm{m}\mathrm{o}\mathrm{d}{q}_2$ is changed as $c_2=r_1\otimes h_2+r_2+(M\oplus \mathrm{H}(c_1))\mathrm{m}\mathrm{o}\mathrm{d}{q}_2$ to provide one of IND-CCA2 components of Dent (2003).

The encapsulation steps are completed by computing the shared key using Kdf. To decapsulate C, $r_1$ and $r_2$ are recovered using secret keys $(f,f_p^{-1},G)$. Then, the recovered message M′ is used to obtain shared key K under Kdf.

In Fig. 3, Kdf and H functions are used to ensure IND-CCA2 security (Dent, 2003; Shoup, 2001).

1. Kdf: It is a cryptographic algorithm that derives one or more secret keys from various values using a pseudo-random function. It is modeled as ROM based on hash function properties. In the proposed KEM, Shoup (2001)’s Kdf1 function ( $R_{q_2}\to \{0,1{\}}^N$) is chosen as Kdf.

2. H: $R_{q_1}\to \{0,1{\}}^N$: It is a hash function that provides entropy smoothing regarding security properties. For high-entropy input ciphertext byte sequences, the output is computationally indistinguishable from a random byte sequence with the same length. In the proposed scheme, SHA series hash function family and National Institute of Standards and Technology (NIST) (2022) and Shoup (2001)’s Kdf1 functions can be used depending on the choice of $\kappa$.

Security analysis of d-ntru kem

In this section, the IND-CCA2 security analysis of the proposed KEM and its resistance to some lattice-based attacks are examined.

The IND-CCA2 security of the proposed KEM

In the security analysis, the idea of IND-CCA2 secure KEM from Dent’s one-way IND-CPA secure encryption scheme (Dent, 2003) is followed. The model of IND-CCA2 security is constructed by adapting (Bogdanov, 2005; Dent, 2003; Shoup, 2001) to the D-NTRU problem. The attacker’s behaviors in the IND-CCA2 security are examined based on the game-based security analysis.

In this model, an Attacker (A), modeled as a PPT Turing machine, has the authority to run all algorithms and can obtain all communication-related media. A can also access the decapsulation oracle to decapsulate any capsulated pair. According to Dent’s KEM structure, the proposed KEM is secure unless A has a significant advantage over the Game₁ against a mythical challenger.

Game₁: There are three consecutive operations, such as start, challenge, and result, in the Game₁. A aims to gain an advantage in the basic IND game by performing these operations. The visualization sub-steps of Game₁ is given in Fig. 4. Figure 4 shows the parameters obtained during the Game₁ based on the action of A. The summarized reactions of Fig. 4 are defined as follows.

• Start: There are three sub-steps.

• s1: Based on the security parameter $\kappa$, the key pair $(pk,sk)$ is generated by the challenger. $pk$ is sent to A and $sk$ is held by the challenger.

• s2: A runs until the challenger receives the capsulated key pair. Then, it queries the decapsulation oracle to find the key that is associated with the capsulated key. It is ready to take on a challenge when A made enough queries.

• s3: The following steps are taken by the A when generating the encapsulated key pair for the challenger. A submits two different capsulated keys:

  • $\star$ $(K_0,C)=\mathrm{E}\mathrm{n}\mathrm{c}\mathrm{a}\mathrm{p}\mathrm{s}\mathrm{u}\mathrm{l}\mathrm{a}\mathrm{t}\mathrm{i}\mathrm{o}\mathrm{n}(pk)$

  • $\star$ $K_1{\leftarrow }^r\{0,1{\}}^N$

• Challenge: It is completed when the following sub-steps are done.

• c1: The challenger chooses bit $\phi {\leftarrow }^r\{0,1\}$ and sends the capsulated key $(K_{\phi },C)$ to A.

• c2: A can perform any number of additional capsulation and computations. According to the number of queries that A can do, the obtained security properties are defined as follows.

  • $\star$ In the non-adaptive IND-CCA, A cannot make further requests to the decapsulation oracle before estimating $\phi$.

  • $\star$ In IND-CCA2, A can make further requests to the decapsulation oracle before the prediction, while the challenger ciphertext C cannot be submitted.

• c3: A works until he/she generates the guess bit ${\phi }^{\mathrm{\prime }}$. Then, A queries the decapsulation oracle to find the ciphertext C, which is associated with the capsulated key pair.

• Result:

1. If ${\phi }^{\mathrm{\prime }}=\phi$, A wins the game.

2. Let $p$ be the advantage of A in Game₀. In Eq. (6), if $p$ is a negligible function of $\kappa$, then the D-NTRU KEM is said to be IND-CCA2 secure.

(6) $$p=Pr[\phi ={\phi }^{\mathrm{\prime }}]-1/2$$

Let’s prove that Eq. (6) is negligible in the proposed KEM with Game₂.

Game₂: In the IND-CCA2 KEM scheme, A can query the decapsulation oracle more than once. Following the idea of Theorem 4 in Dent (2003), the IND-CCA2 analysis of the D-NTRU KEM is examined with Theorem 5. Let;

• |H| be the output length of $H:R_{q_1}\to \{0,1{\}}^N$.

• T be the execution time of encryption process.

• |M| be the space size of $M\in R_{q_2}$.

• $Q_D,Q_H,$ and $Q_K$ be the maximum number of the decapsulation, hash and Kdf oracles queries in the ROM, respectively.

Theorem 5 Let the D-NTRU-(Key Generation, Encryption, Decryption), given in Fig. 2, be a one-way encryption scheme and the D-NTRU KEM be the KEM obtained from this encryption by following Dent’s construction. Suppose that there is an A in the ROM that can break the IND-CCA2 security with probability $p$ in time $t$. Then, there is also an algorithm that inverts the underlying one-way encryption function with probability $p^{\mathrm{\prime }}\ge p-\frac{Q_D}{2^{|H|}}$ − $\frac{Q_D}{|M|}$ and in time $t^{\mathrm{\prime }}\le t+(Q_H+Q_D+Q_K)T$.

Proof 3 It is shown that if there is an A that breaks the proposed scheme with a non-negligible probability, there will be an algorithm that reverses the underlying one-way encryption scheme with a non-negligible probability. Note that it is assumed that A can query the oracle at any time in the IND-CCA2 security. The following changes are done in Game₂.

• The challenger selects the challenge key pair $(K_{\phi },C)$ at the beginning.

• – If A queries the decapsulation oracle with input $C=(C_1,C_2)$, it produces the error term $\mathrm{\perp }$ at any time. The only difference compared with Game₀ is that A queries the decapsulation oracle with ciphertext C before obtaining $(K_{\phi },C)$. To analyze the effects of this difference on the advantage of A, adapted Lemmas 1 and 2 are used.

Lemma 1 Let $Y_1,$ $Y_2$ and Z be an events such that Pr $[Y_1|\mathrm{\neg }Z]$ = Pr $[Y_2|\mathrm{\neg }Z]$. Then,

(7) $$|\mathrm{P}\mathrm{r}[Y_1]-\mathrm{P}\mathrm{r}[Y_2]|\le \mathrm{P}\mathrm{r}[Z]=\frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}},$$where |M| and |H| be the message space size and the output length of H, respectively.

Proof Let $Y_1$ and $Y_2$ be the events that A wins in Game₁ and Game₂, respectively. Note that if A wins the games, he/she can correctly guess $\phi$ from $(K_{\phi },C)$, where $(K_{\phi },C)$ is initially selected at just $Y_2$. Let Z be the event that A asks to decapsulation of C before the challenge is done. If Z does not occur, A can only get the same information when querying oracles. Since, Pr $[Y_1|\mathrm{\neg }Z]$ = Pr $[Y_2|\mathrm{\neg }Z]$, $|\mathrm{P}\mathrm{r}[Y_1]-\mathrm{P}\mathrm{r}[Y_2]|\le \mathrm{P}\mathrm{r}[Z]$ is obtained. In the IND-CCA2, the challenge ciphertext is chosen uniformly random from the possible ciphertext distribution. Since $c_1=(r_1+r_2)\otimes h_1+(p\otimes g+1)\otimes r_2\mathrm{m}\mathrm{o}\mathrm{d}{q}_1$ and $c_2=r_1\otimes h_2+r_2+(M\oplus \mathrm{H}(c_1))\mathrm{m}\mathrm{o}\mathrm{d}{q}_2$, where $C=(c_1,c_2)$ in the proposed KEM, decapsulation and hash oracles are queried in the event Z.

The probability that A guesses C with an decapsulation oracle query is $\frac{1}{|M|}$ and hash oracle is $\frac{1}{|H|}$. Since A can make multiple queries, A can obtain $decapsulation(C,sk)$ and $C^{\mathrm{\prime }}=H(decapsulation(C,sk))$ with a total probability $\frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}}$, if event Z occurs. So, $Y_2$ is only negligibly smaller than $Y_1$ since $\frac{1}{|M|}$ and $\frac{1}{|H|}$ are negligible in the one-way function.

Lemma 2 Let A has a non-negligible advantage in the Game₁. Then, there will also be an A′ with a non-negligible advantage in Game₂.

Proof 2 Suppose that there is an A′ who breaks KEM with probability $p^{\mathrm{\prime }}$ in Game₂. He/She runs the algorithm, given in Fig. 5, to reverse the one-way D-NTRU function. At the end of Algorithm 4, the winning probability of A′ is computed. This value is equal to A′’s success in reversing the challenge ciphertext $C^{\ast }$. Let consider Step 3.b.iii in Fig. 5. The probability of obtaining the plaintext $X^{\ast }$ that creates the challenging ciphertext $C^{\ast }$ is equivalent to the probability that A′ wins Game₂. The derivation of $X^{\ast }$ includes operation steps based on Kdf and H functions. Let V be the event of querying the Kdf function with $X^{\ast }=decapsulation(C^{\ast },sk)$ at any time. The probability of outputting $X^{\ast }$, which is the plaintext of $C^{\ast }$, is computed with Eq. (8).

(8) $$\mathrm{P}\mathrm{r}[X^{\ast }]=\mathrm{P}\mathrm{r}[V]\mathrm{P}\mathrm{r}[X^{\ast }|V]+\mathrm{P}\mathrm{r}[\mathrm{\neg }V]\mathrm{P}\mathrm{r}[X^{\ast }|\mathrm{\neg }V]$$when the event V does not occur, A cannot obtain anything about $kdf(X^{\ast })=Decapsulation(C^{\ast },sk).$ So, $\mathrm{P}\mathrm{r}[\mathrm{\neg }V]=0$. $\mathrm{P}\mathrm{r}[V]=\frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}}$ is obtained with Eq. (7). If Eq. (8) is rewritten, Eq. (9) is obtained.

(9) $$\begin{array}{rl}\mathrm{P}\mathrm{r}[X^{\ast }]=& \stackrel{\frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}}}{\overbrace{\mathrm{P}\mathrm{r}[V]}}\stackrel{\equiv 1}{\overbrace{\mathrm{P}\mathrm{r}[X^{\ast }|V]}}+\stackrel{0}{\overbrace{\mathrm{P}\mathrm{r}[\mathrm{\neg }V]}}\mathrm{P}\mathrm{r}[X^{\ast }|\mathrm{\neg }V]\\ \le & \mathrm{P}\mathrm{r}[V]\\ \le & \frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}}\end{array}$$

Since Kdf is modeled as a ROM and the D-NTRU provides one-wayness property, the total number of queries $\frac{Q_D}{|M|}+\frac{Q_D}{2^{|H|}}$ as a function of $\kappa$ is negligible. Since Eq. (6) is hold, there is no an algorithm that can reverse the given $C^{\ast }$ ciphertext is obtained with a negligible. So, the proposed D-NTRU-based KEM is IND-CCA2 secure.

Comparison

In this section, the proposed parameter set and the comparison analysis of the D-NTRU KEM are presented. The parameter set, given in Table 3, is obtained by adapting the NTRU parameters according to the correctness and security analysis. To compare with the NTRU-based schemes, we developed a python script (Seyhan, Akleylek & Dursun, 2023) based on the D-NTRU KEM bounds and the default values of Chen et al. (2022). Table 3 presents the lattice size, modulo, distribution, and the security parameters of proposed the D-NTRU KEM for $128$, $192$, and $256$-bit security levels.

The theoretical basis of the proposed KEM is explained in Table 2. Based on Table 2, the developed script (Seyhan, Akleylek & Dursun, 2023) was used to determine the suitable parameters and sizes. By following the message and key security computation, the values N and $d$ are determined for each security level. The twin primes $q_1$ and $q_2$ are chosen to satisfy failure condition $q_1>40d-18$, where $q_1+2=q_2$. The ntruhps (Chen et al., 2022) values were selected as a reference for comparison.

By using Tables 2 and 3, the computed components of the D-NTRU KEM are presented in Table 4. In Table 4, the public/secret keys and ciphertext sizes are obtained in bytes using script (Seyhan, Akleylek & Dursun, 2023). Since no other D-NTRU-based IND-CCA2 KEM exists in the literature, the comparison can be made with the NTRU-based ones such as ntruhps (Chen et al., 2022). According to Table 4, the proposed KEM provides relatively larger key and ciphertext sizes for the same security level. The main parameters such as lattice size, moduli value, error bounds, parameter/message distributions, and security components that cause the differences of compared schemes are expressed in Table 5. Different hard problems and special requirements cause these differences. According to comparison analysis, the proposed method is characterized by the absence of any padding mechanism and arithmetically simple operations.

Conclusion

In this article, we construct a novel D-NTRU-based KEM scheme. It provides a solution to define IND-CCA2 security of the D-NTRU-based encryption, an open problem in Wang, Lei & Hu (2018). The security of the proposed KEM relies on the hardness assumption of the D-NTRU problem. Based on the one-way D-NTRU IND-CPA encryption scheme, IND-CCA2 secure D-NTRU KEM is constructed by following Dent’s KEM architecture (Dent, 2003). The detailed security analysis is done in the ROM according to modified Dent assumptions for the D-NTRU-based structures. The basic lattice-based attack evaluations are also presented. The proposed KEM is the first IND-CCA2 secure D-NTRU-based KEM in the literature. It has a simple design and the fact that it does not involve any padding mechanisms. The D-NTRU KEM trivializes the large key and ciphertext sizes. As a future work, we will focus on the D-NTRU-based KEM schemes, including methods such as NAEP padding and their security analysis in the quantum random oracle (QROM) model.

Supplemental Information