SherbyNet - /page/wikibook/entry.mu

<!DOCTYPE html>

<title>Key encapsulation mechanism</title>

</head>

Key encapsulation mechanism

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div role="note" class="hatnote navigation-not-searchable">Not to be confused with <a href="Key_wrap" title="Key wrap">key wrap</a>.</div>

In <a href="Cryptography" title="Cryptography">cryptography</a>, a key encapsulation mechanism (KEM) is a <a href="Public-key_cryptography" title="Public-key cryptography">public-key cryptosystem</a> that allows a sender to generate a short secret key and transmit it to a receiver confidentially, in spite of <a href="Network_eavesdropping" title="Network eavesdropping">eavesdropping</a> and <a href="Man-in-the-middle_attack" title="Man-in-the-middle attack">intercepting</a> adversaries.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a> Modern standards for <a href="Public-key_encryption" class="mw-redirect" title="Public-key encryption">public-key encryption</a> of arbitrary messages are usually based on KEMs.<a href="#cite_note-fips203-4">[4]</a><a href="#cite_note-rfc9180-5">[5]</a>

A KEM allows a sender who knows a public key to simultaneously generate a short random secret key and an encapsulation or ciphertext of the secret key by the KEM's encapsulation algorithm.

The receiver who knows the private key corresponding to the public key can recover the same random secret key from the encapsulation by the KEM's decapsulation algorithm.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a>

The security goal of a KEM is to prevent anyone who does not know the private key from recovering any information about the encapsulated secret keys, even after eavesdropping or submitting other encapsulations to the receiver to study how the receiver reacts.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a>

<div class="mw-heading mw-heading2"><h2 id="Difference_from_public-key_encryption">Difference from public-key encryption</h2></div>

The difference between a <a href="Public-key_encryption" class="mw-redirect" title="Public-key encryption">public-key encryption</a> scheme and a KEM is that a public-key encryption scheme allows a sender to choose an arbitrary message from some space of possible messages, while a KEM chooses a short secret key at random for the sender.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a>

The sender may take the random secret key produced by a KEM and use it as a <a href="Symmetric_key" class="mw-redirect" title="Symmetric key">symmetric key</a> for an <a href="Authenticated_encryption" title="Authenticated encryption">authenticated cipher</a> whose ciphertext is sent alongside the encapsulation to the receiver.

This serves to compose a public-key encryption scheme out of a KEM and a symmetric-key authenticated cipher in a <a href="Hybrid_cryptosystem" title="Hybrid cryptosystem">hybrid cryptosystem</a>.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a><a href="#cite_note-rfc9180-5">[5]</a>

Most public-key encryption schemes such as <a href="PKCS_1" title="PKCS 1">RSAES-PKCS1-v1_5</a>, <a href="Optimal_asymmetric_encryption_padding" title="Optimal asymmetric encryption padding">RSAES-OAEP</a>, and <a href="Elgamal_encryption" class="mw-redirect" title="Elgamal encryption">Elgamal encryption</a> are limited to small messages<a href="#cite_note-rfc8017-6">[6]</a><a href="#cite_note-menezes-vanoorschoot-vanstone1996hac-7">[7]</a> and are almost always used to encrypt a short random secret key in a hybrid cryptosystem anyway.<a href="#cite_note-ferguson-kohno-schneier2010cryptoengineering-8">[8]</a><a href="#cite_note-rfc4880-9">[9]</a><a href="#cite_note-rfc9180-5">[5]</a>

And although a public-key encryption scheme can conversely be converted to a KEM by choosing a random secret key and encrypting it as a message, it is easier to design and analyze a secure KEM than to design a secure public-key encryption scheme as a basis.

So most modern public-key encryption schemes are based on KEMs rather than the other way around.<a href="#cite_note-nist-pqc-faqs-10">[10]</a><a href="#cite_note-rfc9180-5">[5]</a>

<div class="mw-heading mw-heading2"><h2 id="Definition">Definition</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Syntax">Syntax</h3></div>

A KEM consists of three algorithms:<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a><a href="#cite_note-dent2002designerkem-11">[11]</a><a href="#cite_note-hofheinz-hövelmanns-kiltz2017modularfo-12">[12]</a>

<ol><li>Key generation, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}">

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}</annotation>

</semantics>

</math><img src="./bd8c9b5bedd069cd789c297c5b5d41b103e2a310.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.825ex; height:2.843ex;" alt="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}" loading="lazy">, takes no inputs and returns a pair of a public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}}</annotation>

</semantics>

</math><img src="./c74105ac9a9612666b04c1c00054aea52005de98.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-right: -0.088ex; width:2.346ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}}" loading="lazy"> and a private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}}</annotation>

</semantics>

</math><img src="./49d12ff5920ef53458670d03c4bddd6149ba1668.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; margin-right: -0.088ex; width:2.109ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}}" loading="lazy">.</li>

<li>Encapsulation, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}">

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./97dffd1729f2fde6f7db7e6801f076fa1549e189.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:19.236ex; height:2.843ex;" alt="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy">, takes a public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}}</annotation>

</semantics>

</math><img src="./c74105ac9a9612666b04c1c00054aea52005de98.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-right: -0.088ex; width:2.346ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}}" loading="lazy">, randomly chooses a secret key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy">, and returns <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy"> along with its encapsulation <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c}</annotation>

</semantics>

</math><img src="./86a67b81c2de995bd608d5b2df50cd8cd7d92455.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.007ex; height:1.676ex;" alt="{\displaystyle c}" loading="lazy">.</li>

<li>Decapsulation, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}">

<msup>

</msup>

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./a52f9a280661946e980d640ad3546137b90b564c.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.492ex; height:3.009ex;" alt="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy">, takes a private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}}</annotation>

</semantics>

</math><img src="./49d12ff5920ef53458670d03c4bddd6149ba1668.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; margin-right: -0.088ex; width:2.109ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}}" loading="lazy"> and an encapsulation <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy">, and either returns an encapsulated secret key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k'}</annotation>

</semantics>

</math><img src="./51a2b832ed184c7b6481b3926bf8172d353fa7de.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.896ex; height:2.509ex;" alt="{\displaystyle k'}" loading="lazy"> or fails, sometimes denoted by returning <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \bot }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \bot }</annotation>

</semantics>

</math><img src="./f282c7bc331cc3bfcf1c57f1452cc23c022f58de.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.808ex; height:2.176ex;" alt="{\displaystyle \bot }" loading="lazy"> (called ‘<a href="Up_tack" title="Up tack">bottom</a>’).</li></ol>

In the <a href="Asymptotic_analysis" title="Asymptotic analysis">asymptotic setting</a> of theoretical cryptography, the algorithms are all <a href="Probabilistic_polynomial-time" class="mw-redirect" title="Probabilistic polynomial-time">probabilistic polynomial-time</a> in a security parameter <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \lambda }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \lambda }</annotation>

</semantics>

</math><img src="./b43d0ea3c9c025af1be9128e62a18fa74bedda2a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.355ex; height:2.176ex;" alt="{\displaystyle \lambda }" loading="lazy">, and the length of the secret key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy"> is a function of the security parameter <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \lambda }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \lambda }</annotation>

</semantics>

</math><img src="./b43d0ea3c9c025af1be9128e62a18fa74bedda2a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.355ex; height:2.176ex;" alt="{\displaystyle \lambda }" loading="lazy">.<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a>

In practical cryptography, the secret key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy"> is usually of a fixed length for each algorithm.

For example, <a href="ML-KEM" class="mw-redirect" title="ML-KEM">ML-KEM</a> always uses 256-bit secret keys,<a href="#cite_note-fips203-4">[4]</a>: § 3.3, p. 16 while the algorithms in <style data-mw-deduplicate="TemplateStyles:r1238218222">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><a href="RFC_(identifier)" class="mw-redirect" title="RFC (identifier)">RFC</a> <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc9180">9180</a> vary between 256-, 384-, and 512-bit secret keys;<a href="#cite_note-rfc9180-5">[5]</a>: § 7.1 secret keys of arbitrary length can be derived from <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy"> by a <a href="Key_derivation_function" title="Key derivation function">key derivation function</a>.<a href="#cite_note-NIST.SP.800-227-13">[13]</a>: § 5.3 <a href="#cite_note-rfc9180-5">[5]</a>

<div class="mw-heading mw-heading4"><h4 id="Explicit_vs._implicit_rejection">Explicit vs. implicit rejection</h4></div>

Decapsulation can fail because its input <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> is not an encapsulation <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c}</annotation>

</semantics>

</math><img src="./86a67b81c2de995bd608d5b2df50cd8cd7d92455.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.007ex; height:1.676ex;" alt="{\displaystyle c}" loading="lazy"> returned by Encap, but has been tampered with or maliciously crafted.

KEMs which report failure by a distinguished symbol <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \bot }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \bot }</annotation>

</semantics>

</math><img src="./f282c7bc331cc3bfcf1c57f1452cc23c022f58de.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.808ex; height:2.176ex;" alt="{\displaystyle \bot }" loading="lazy"> (implemented in practice by returning an error code or raising an exception) are said to use explicit rejection.

A KEM may instead return a random secret key in this event, or a secret key derived <a href="Pseudorandom_function_family" title="Pseudorandom function family">pseudorandomly</a> from <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> under the key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle sk}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle sk}</annotation>

</semantics>

</math><img src="./6460cb8e220465e748ae56d01e5ee1126a44fef4.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.302ex; height:2.176ex;" alt="{\displaystyle sk}" loading="lazy">; this is called implicit rejection.<a href="#cite_note-Persichetti2012thesis-14">[14]</a>: § 5.3, pp. 76–78 <a href="#cite_note-hofheinz-hövelmanns-kiltz2017modularfo-12">[12]</a>

<div class="mw-heading mw-heading3"><h3 id="Correctness">Correctness</h3></div>

A KEM is correct if, for any key pair <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle ({\mathit {pk}},{\mathit {sk}})}">

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle ({\mathit {pk}},{\mathit {sk}})}</annotation>

</semantics>

</math><img src="./7d8fec5d86fad3c81a34b3c281a8f039b149fcfe.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:7.121ex; height:2.843ex;" alt="{\displaystyle ({\mathit {pk}},{\mathit {sk}})}" loading="lazy"> generated by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \operatorname {Gen} }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \operatorname {Gen} }</annotation>

</semantics>

</math><img src="./1303d48213dd7e765bdafac997406d751bf3feea.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:4.149ex; height:2.176ex;" alt="{\displaystyle \operatorname {Gen} }" loading="lazy">, decapsulating an encapsulation <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c}</annotation>

</semantics>

</math><img src="./86a67b81c2de995bd608d5b2df50cd8cd7d92455.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.007ex; height:1.676ex;" alt="{\displaystyle c}" loading="lazy"> returned by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}">

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./97dffd1729f2fde6f7db7e6801f076fa1549e189.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:19.236ex; height:2.843ex;" alt="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy"> with high probability yields the same key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k}</annotation>

</semantics>

</math><img src="./c3c9a2c7b599b37105512c5d570edc034056dd40.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.211ex; height:2.176ex;" alt="{\displaystyle k}" loading="lazy">, that is, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c)=k}">

<mi>Decap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \operatorname {Decap} ({\mathit {sk}},c)=k}</annotation>

</semantics>

</math><img src="./0385ee3e5068932c9f100799092be4f8b0379c04.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.476ex; height:2.843ex;" alt="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c)=k}" loading="lazy">.<a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a><a href="#cite_note-dent2002designerkem-11">[11]</a><a href="#cite_note-hofheinz-hövelmanns-kiltz2017modularfo-12">[12]</a>

<div class="mw-heading mw-heading3"><h3 id="Security:_IND-CCA">Security: IND-CCA</h3></div>

Security of a KEM is quantified by its <a href="Ciphertext_indistinguishability" title="Ciphertext indistinguishability">indistinguishability against adaptive chosen-ciphertext attack</a>, IND-CCA, which is loosely how much better an adversary can do than a coin toss to tell whether, given a random key and an encapsulation, the key is encapsulated by that encapsulation or is an independent random key.<a href="#cite_note-shoup2000hashhedgecca-2">[2]</a><a href="#cite_note-cramer-shoup2003pkecca-3">[3]</a><a href="#cite_note-dent2002designerkem-11">[11]</a><a href="#cite_note-hofheinz-hövelmanns-kiltz2017modularfo-12">[12]</a><a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a>

Specifically, in the IND-CCA game:

<ol><li>The key generation algorithm is run to generate <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}">

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}</annotation>

</semantics>

</math><img src="./bd8c9b5bedd069cd789c297c5b5d41b103e2a310.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.825ex; height:2.843ex;" alt="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}" loading="lazy">.</li>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}}</annotation>

</semantics>

</math><img src="./c74105ac9a9612666b04c1c00054aea52005de98.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-right: -0.088ex; width:2.346ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}}" loading="lazy"> is revealed to the adversary.</li>

<li>The adversary can query <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}">

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./0f26c2b7fea9f2616ad0bad0ef005f0a027a763b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:12.851ex; height:3.009ex;" alt="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy"> for arbitrary encapsulations <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> of the adversary's choice.</li>

<li>The encapsulation algorithm is run to randomly generate a secret key and encapsulation <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (k_{0},c):=\operatorname {Encap} ({\mathit {pk}})}">

<msub>

</mrow>

</msub>

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k_{0},c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./92e1e655ede537f93f4b9f3fe2877a82faf9e1e1.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.29ex; height:2.843ex;" alt="{\displaystyle (k_{0},c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy">, and another secret key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k_{1}}">

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k_{1}}</annotation>

</semantics>

</math><img src="./376315fd4983f01dada5ec2f7bebc48455b14a66.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:2.265ex; height:2.509ex;" alt="{\displaystyle k_{1}}" loading="lazy"> is generated independently at random.</li>

<li>A fair coin is tossed, giving an outcome <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle b\in \{0,1\}}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle b\in \{0,1\}}</annotation>

</semantics>

</math><img src="./b250aa33a7d342ab8b242e87ec4690bd0b5b8dd6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.522ex; height:2.843ex;" alt="{\displaystyle b\in \{0,1\}}" loading="lazy">.</li>

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k_{b},c)}</annotation>

</semantics>

</math><img src="./e57f9e03962ee9370a59c65b73484e97450f887c.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.999ex; height:2.843ex;" alt="{\displaystyle (k_{b},c)}" loading="lazy"> is revealed to the adversary.</li>

<li>The adversary can again query <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}">

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./0f26c2b7fea9f2616ad0bad0ef005f0a027a763b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:12.851ex; height:3.009ex;" alt="{\displaystyle \operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy"> for arbitrary encapsulations <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> of the adversary's choice, except for <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c}</annotation>

</semantics>

</math><img src="./86a67b81c2de995bd608d5b2df50cd8cd7d92455.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.007ex; height:1.676ex;" alt="{\displaystyle c}" loading="lazy">.</li>

<li>The adversary returns a guess <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle b'\in \{0,1\}}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle b'\in \{0,1\}}</annotation>

</semantics>

</math><img src="./9b8091db74767a70de2dce6505357f11e6873692.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:10.207ex; height:3.009ex;" alt="{\displaystyle b'\in \{0,1\}}" loading="lazy">, and wins the game if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle b=b'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle b=b'}</annotation>

</semantics>

</math><img src="./958ee5aa7439f8f632ce3f87359ba99b1bf379b6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:5.778ex; height:2.509ex;" alt="{\displaystyle b=b'}" loading="lazy">.</li></ol>

The IND-CCA advantage of the adversary is <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \left|\Pr[b'=b]-1/2\right|}">

<mrow>

<mrow>

<msup>

</msup>

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \left|\Pr[b'=b]-1/2\right|}</annotation>

</semantics>

</math><img src="./f6bca587c4ff5305de69acbb9ae92751cbb59a26.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:17.188ex; height:3.009ex;" alt="{\displaystyle \left|\Pr[b'=b]-1/2\right|}" loading="lazy">, that is, the probability beyond a fair coin toss at correctly distinguishing an encapsulated key from an independently randomly chosen key.

<div class="mw-heading mw-heading2"><h2 id="Applications">Applications</h2></div>

<div class="mw-heading mw-heading3"><h3 id="Public-key_encryption">Public-key encryption</h3></div>

A key encapsulation mechanism can be used together with an <a href="Authenticated_encryption" title="Authenticated encryption">authenticated</a> <a href="Symmetric-key_cryptography" class="mw-redirect" title="Symmetric-key cryptography">symmetric cipher</a> to construct a <a href="Public-key_encryption" class="mw-redirect" title="Public-key encryption">public-key encryption</a> scheme for arbitrary messages.

The security requirement for the symmetric cipher, called a data encapsulation mechanism or DEM, is <a href="Ciphertext_indistinguishability" title="Ciphertext indistinguishability">indistinguishability against chosen-ciphertext attack</a> for a single message encrypted by the sender.<a href="#cite_note-shoup2001isoproposal-15">[15]</a><a href="#cite_note-dent2002designerkem-11">[11]</a><a href="#cite_note-rfc9690-16">[16]</a>

Given a secure KEM with algorithms Gen/Encap/Decap, and a secure DEM <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle E_{k}(m)}">

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle E_{k}(m)}</annotation>

</semantics>

</math><img src="./d75ae2b4724f38e3328f261a21f59719cd321dcd.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:6.654ex; height:2.843ex;" alt="{\displaystyle E_{k}(m)}" loading="lazy">, the following <a href="Hybrid_cryptosystem" title="Hybrid cryptosystem">hybrid public-key encryption scheme</a> is also secure against adaptive chosen-ciphertext attack in the public-key setting:<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a><a href="#cite_note-shoup2000hashhedgecca-2">[2]</a>: § 7.2, Theorem 7.3 <a href="#cite_note-NIST.SP.800-227-13">[13]</a>: § 6.2.1

<ul><li>Key generation: Same as the KEM.</li>

<li>To encrypt a message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> for a public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}}</annotation>

</semantics>

</math><img src="./c74105ac9a9612666b04c1c00054aea52005de98.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-right: -0.088ex; width:2.346ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}}" loading="lazy">:

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./97dffd1729f2fde6f7db7e6801f076fa1549e189.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:19.236ex; height:2.843ex;" alt="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy">.</li>

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \sigma :=E_{k}(m)}</annotation>

</semantics>

</math><img src="./fb5475009b1d2d6b5459089887138da50aff9a0a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.729ex; height:2.843ex;" alt="{\displaystyle \sigma :=E_{k}(m)}" loading="lazy">.</li>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (c,\sigma )}</annotation>

</semantics>

</math><img src="./74ec870f786f2ce758de07396380d01819b23f94.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.18ex; height:2.843ex;" alt="{\displaystyle (c,\sigma )}" loading="lazy"> as the ciphertext.</li></ol></li>

<li>To decrypt a ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (c',\sigma ')}">

<msup>

</msup>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (c',\sigma ')}</annotation>

</semantics>

</math><img src="./81ff19bc0ec768b9edfebe6533a04d1508084f94.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:6.55ex; height:3.009ex;" alt="{\displaystyle (c',\sigma ')}" loading="lazy"> with private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}}</annotation>

</semantics>

</math><img src="./49d12ff5920ef53458670d03c4bddd6149ba1668.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; margin-right: -0.088ex; width:2.109ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}}" loading="lazy">:

<msup>

</msup>

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./a52f9a280661946e980d640ad3546137b90b564c.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.492ex; height:3.009ex;" alt="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy">, or fail if it fails.</li>

<li>Return the message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle E_{k'}^{-1}(\sigma ')}">

<msup>

</msup>

</mrow>

</mrow>

</msubsup>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle E_{k'}^{-1}(\sigma ')}</annotation>

</semantics>

</math><img src="./a8b168707677eb6c4178121b7063a853fe6e88dc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.338ex; width:7.951ex; height:3.676ex;" alt="{\displaystyle E_{k'}^{-1}(\sigma ')}" loading="lazy">, or fail if it fails.</li></ol></li></ul>

Note that—as with any public-key encryption on its own—this does not authenticate the sender: anyone with the public key can send a message to a recipient with the private key.

Other cryptography, such as <a href="Digital_signatures" class="mw-redirect" title="Digital signatures">digital signatures</a>, must be used in a protocol for a sender to prove its identity to the receiver.<a href="#cite_note-an2001pkae-17">[17]</a>

The use of an authenticated symmetric cipher is nevertheless required in this anonymous public-key encryption scheme to meet IND-CCA security.

If an unauthenticated cipher were used, secure only against chosen-plaintext attack (IND-CPA), an adversary could <a href="Malleability_(cryptography)" title="Malleability (cryptography)">selectively modify</a> a message through its ciphertext in transit, which not only fails IND-CCA on a technicality<a href="#cite_note-BDPR1998pkesecrelations-18">[18]</a> but also can compromise confidentiality in practice as in <a href="EFAIL" title="EFAIL">EFAIL</a>.<a href="#cite_note-2018EFAIL-19">[19]</a>

<div class="mw-heading mw-heading3"><h3 id="Key_agreement_protocols">Key agreement protocols</h3></div>

A KEM can also be used in an <a href="Authenticated_key_agreement" class="mw-redirect" title="Authenticated key agreement">authenticated key agreement</a> protocol such as <a href="Transport_Layer_Security" title="Transport Layer Security">TLS</a> with <a href="Forward_secrecy" title="Forward secrecy">forward secrecy</a> for an online session, by having the client and server generate KEM key pairs and exchange signed encapsulations using those key pairs, which they then erase at the end of the session.<a href="#cite_note-NIST.SP.800-227-13">[13]</a>

<div class="mw-heading mw-heading3"><h3 id="Combining_KEMs">Combining KEMs</h3></div>

Different KEMs rely on different mathematical problems for their security.

For example, the security of Rabin-KEM relies on the difficulty of <a href="Integer_factorization" title="Integer factorization">integer factorization</a><a href="#cite_note-dent2002designerkem-11">[11]</a>, which has been studied for centuries, but is known to be vulnerable to quantum computers capable of running <a href="Shor's_algorithm" title="Shor's algorithm">Shor's algorithm</a>.

In contrast, the security of <a href="ML-KEM" class="mw-redirect" title="ML-KEM">ML-KEM</a> relies on the difficulty of <a href="Learning_with_errors" title="Learning with errors">learning with errors</a>,<a href="#cite_note-fips203-4">[4]</a> which has only been studied for decades, but is not known to be vulnerable even to an adversary with a Shor-capable quantum computer.

A KEM combiner is a scheme for combining two KEMs, KEM1 and KEM2 with respective encapsulation algorithms KEM1.Encap and KEM2.Encap and so on, into a combined KEM which is secure if either KEM1 or KEM2 is secure.<a href="#cite_note-Giacon-Hauer-Poettering2018kemcombiners-20">[20]</a>

A KEM that combines a quantum-vulnerable KEM such as DH-KEM using <a href="X25519" class="mw-redirect" title="X25519">X25519</a> with a <a href="Post-quantum_cryptography" title="Post-quantum cryptography">post-quantum</a> KEM such as <a href="ML-KEM" class="mw-redirect" title="ML-KEM">ML-KEM</a> is sometimes called a <a href="Post-quantum_cryptography#Hybrid_encryption" title="Post-quantum cryptography">hybrid</a>,<a href="#cite_note-10.1007_978-3-030-25510-7-21">[21]</a><a href="#cite_note-nist-pqc-faqs-10">[10]</a><a href="#cite_note-ETSI_TS_103_744_V1.1.1-22">[22]</a> not to be confused with a <a href="Hybrid_cryptosystem" title="Hybrid cryptosystem">hybrid cryptosystem</a> which combines <a href="Public-key_cryptography" title="Public-key cryptography">public-key cryptography</a> with <a href="Symmetric-key_cryptography" class="mw-redirect" title="Symmetric-key cryptography">symmetric-key cryptography</a>.

<div class="mw-heading mw-heading2"><h2 id="Examples_and_motivation">Examples and motivation</h2></div>

Traditional <a href="RSA_encryption" class="mw-redirect" title="RSA encryption">RSA encryption</a>, with <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t}</annotation>

</semantics>

</math><img src="./65658b7b223af9e1acc877d848888ecdb4466560.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.84ex; height:2.009ex;" alt="{\displaystyle t}" loading="lazy">-bit moduli and exponent <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle e}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle e}</annotation>

</semantics>

</math><img src="./cd253103f0876afc68ebead27a5aa9867d927467.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.083ex; height:1.676ex;" alt="{\displaystyle e}" loading="lazy">, is defined as follows:<a href="#cite_note-aumasson2018seriouscrypto-23">[23]</a><a href="#cite_note-stinson2006cryptotheorypracticebook-24">[24]</a><a href="#cite_note-rsa1978method-25">[25]</a>

<ul><li>Key generation, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}">

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}</annotation>

</semantics>

</math><img src="./bd8c9b5bedd069cd789c297c5b5d41b103e2a310.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.825ex; height:2.843ex;" alt="{\displaystyle ({\mathit {pk}},{\mathit {sk}}):=\operatorname {Gen} ()}" loading="lazy">:</li></ul>

<ol><li>Generate a <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t}</annotation>

</semantics>

</math><img src="./65658b7b223af9e1acc877d848888ecdb4466560.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.84ex; height:2.009ex;" alt="{\displaystyle t}" loading="lazy">-bit <a href="Semiprime" title="Semiprime">semiprime</a> <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle n}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle n}</annotation>

</semantics>

</math><img src="./a601995d55609f2d9f5e233e36fbe9ea26011b3b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.395ex; height:1.676ex;" alt="{\displaystyle n}" loading="lazy"> with <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 2^{t-1}<n<2^{t}}">

<msup>

</mrow>

</msup>

<msup>

</mrow>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 2^{t-1}<n<2^{t}}</annotation>

</semantics>

</math><img src="./f33181a3fae3e310b0af946669f5a09f2949df12.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:13.669ex; height:2.676ex;" alt="{\displaystyle 2^{t-1}<n<2^{t}}" loading="lazy"> at random satisfying <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \gcd(e,\lambda (n))=1}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \gcd(e,\lambda (n))=1}</annotation>

</semantics>

</math><img src="./98035e380c29b12488970d40b18842505fab797b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.234ex; height:2.843ex;" alt="{\displaystyle \gcd(e,\lambda (n))=1}" loading="lazy">, where <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \lambda (n)}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \lambda (n)}</annotation>

</semantics>

</math><img src="./8f06b26d7cb84392c1891a14c32c4dbe7e3f5e92.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:4.559ex; height:2.843ex;" alt="{\displaystyle \lambda (n)}" loading="lazy"> is the <a href="Carmichael_function" title="Carmichael function">Carmichael function</a>.</li>

<li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle d:=e^{-1}{\bmod {\lambda }}(n)}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle d:=e^{-1}{\bmod {\lambda }}(n)}</annotation>

</semantics>

</math><img src="./28a5d72c094cedbcc56629168d43456f32a3ed34.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.618ex; height:3.176ex;" alt="{\displaystyle d:=e^{-1}{\bmod {\lambda }}(n)}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}:=n}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}:=n}</annotation>

</semantics>

</math><img src="./fb5cae58278d26d35ff57b48d732cc1317e52b26.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:7.398ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}:=n}" loading="lazy"> as the public key and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}:=(n,d)}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}:=(n,d)}</annotation>

</semantics>

</math><img src="./0d8480255dc660330c315947f14350aacaca27fd.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.22ex; height:2.843ex;" alt="{\displaystyle {\mathit {sk}}:=(n,d)}" loading="lazy"> as the private key. (Many variations on key generation algorithms and private key formats are available.<a href="#cite_note-svenda2016mkq-26">[26]</a>)</li></ol>

<ul><li>Encryption of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (t-1)}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (t-1)}</annotation>

</semantics>

</math><img src="./1d822b730c9fa7342d2557b5a35e9e36b38efbd3.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:6.652ex; height:2.843ex;" alt="{\displaystyle (t-1)}" loading="lazy">-bit message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> to public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}=n}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}=n}</annotation>

</semantics>

</math><img src="./419b21283eaea2e0d806285d09831c4ff1bbca7b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:6.751ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}=n}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}">

<mi>Encrypt</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}</annotation>

</semantics>

</math><img src="./acba1309d5336b8332452c3606b0341a74750802.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.137ex; height:2.843ex;" alt="{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}" loading="lazy">:</li></ul>

<ol><li>Encode the bit string <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> as an integer <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r}</annotation>

</semantics>

</math><img src="./0d1ecb613aa2984f0576f70f86650b7c2a132538.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.049ex; height:1.676ex;" alt="{\displaystyle r}" loading="lazy"> with <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 0\leq r<n}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 0\leq r<n}</annotation>

</semantics>

</math><img src="./7ba223befaf10cf81c9d56afef11b52ab73f81c9.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.505ex; width:9.803ex; height:2.343ex;" alt="{\displaystyle 0\leq r<n}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=r^{e}{\bmod {n}}}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=r^{e}{\bmod {n}}}</annotation>

</semantics>

</math><img src="./1e0232243688f96e5ad87690961b2162434035b1.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:13.875ex; height:2.343ex;" alt="{\displaystyle c:=r^{e}{\bmod {n}}}" loading="lazy">.</li></ol>

<ul><li>Decryption of ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> with private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}=(n,d)}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}=(n,d)}</annotation>

</semantics>

</math><img src="./c0df04bb29a3e6e13f5df0eb45ca44aec498a0e0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:10.573ex; height:2.843ex;" alt="{\displaystyle {\mathit {sk}}=(n,d)}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}">

<msup>

</msup>

<mi>Decrypt</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./3ec6570c8ffbbddb6f6b779b83f4554d82a79217.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:21.203ex; height:3.009ex;" alt="{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}" loading="lazy">:</li></ul>

<ol><li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r':=(c')^{d}{\bmod {n}}}">

<msup>

</msup>

<msup>

</msup>

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r':=(c')^{d}{\bmod {n}}}</annotation>

</semantics>

</math><img src="./4e8c1e6dac48cbeef26c7e58c90347b573fc70a7.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:17.147ex; height:3.176ex;" alt="{\displaystyle r':=(c')^{d}{\bmod {n}}}" loading="lazy">.</li>

<li>Decode the integer <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r'}</annotation>

</semantics>

</math><img src="./20f4d06078c3550f2cd0812005ba6301d12cc4c0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.733ex; height:2.509ex;" alt="{\displaystyle r'}" loading="lazy"> as a bit string <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m'}</annotation>

</semantics>

</math><img src="./b2ea8347f7588b19652c2098395f059d76b12b60.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.725ex; height:2.509ex;" alt="{\displaystyle m'}" loading="lazy">.</li></ol>

This naive approach is totally insecure.

For example, since it is nonrandomized, it cannot be secure against even <a href="Known-plaintext_attack" title="Known-plaintext attack">known-plaintext attack</a>—an adversary can tell whether the sender is sending the message <code>ATTACK AT DAWN</code> versus the message <code>ATTACK AT DUSK</code> simply by encrypting those messages and comparing the ciphertext.

Even if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> is always a random secret key, such as a 256-bit <a href="Advanced_Encryption_Standard" title="Advanced Encryption Standard">AES</a> key, when <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle e}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle e}</annotation>

</semantics>

</math><img src="./cd253103f0876afc68ebead27a5aa9867d927467.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.083ex; height:1.676ex;" alt="{\displaystyle e}" loading="lazy"> is chosen to optimize efficiency as <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle e=3}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle e=3}</annotation>

</semantics>

</math><img src="./2971339e7da12fa59af242d68484fa34b181342d.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:5.344ex; height:2.176ex;" alt="{\displaystyle e=3}" loading="lazy">, the message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> can be computed from the ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c}</annotation>

</semantics>

</math><img src="./86a67b81c2de995bd608d5b2df50cd8cd7d92455.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.007ex; height:1.676ex;" alt="{\displaystyle c}" loading="lazy"> simply by taking real number cube roots, and there are many other <a href="RSA_(cryptosystem)" class="mw-redirect" title="RSA (cryptosystem)">attacks against plain RSA</a>.<a href="#cite_note-aumasson2018seriouscrypto-23">[23]</a><a href="#cite_note-stinson2006cryptotheorypracticebook-24">[24]</a>

Various <a href="RSA_(cryptosystem)" class="mw-redirect" title="RSA (cryptosystem)">randomized padding schemes</a> have been devised in attempts—sometimes failed, like <a href="PKCS_1" title="PKCS 1">RSAES-PKCS1-v1_5</a><a href="#cite_note-aumasson2018seriouscrypto-23">[23]</a><a href="#cite_note-bleichenbacher1998pkcs1cca-27">[27]</a><a href="#cite_note-coron-joye-naccache-paillier2000newpkcs1attacks-28">[28]</a>—to make it secure for arbitrary short messages <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy">.<a href="#cite_note-aumasson2018seriouscrypto-23">[23]</a><a href="#cite_note-stinson2006cryptotheorypracticebook-24">[24]</a>

Since the message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> is almost always a short secret key for a <a href="Symmetric-key" class="mw-redirect" title="Symmetric-key">symmetric-key</a> <a href="Authenticated_encryption" title="Authenticated encryption">authenticated cipher</a> used to encrypt an arbitrary bit string message, a simpler approach called RSA-KEM is to choose an element of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \mathbb {Z} /n\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \mathbb {Z} /n\mathbb {Z} }</annotation>

</semantics>

</math><img src="./f2120ebbc85f91df66c6de5446367bf9fd620844.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.658ex; height:2.843ex;" alt="{\displaystyle \mathbb {Z} /n\mathbb {Z} }" loading="lazy"> at random and use that to derive a secret key using a <a href="Key_derivation_function" title="Key derivation function">key derivation function</a> <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle H}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle H}</annotation>

</semantics>

</math><img src="./75a9edddcca2f782014371f75dca39d7e13a9c1b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.064ex; height:2.176ex;" alt="{\displaystyle H}" loading="lazy">, roughly as follows:<a href="#cite_note-shoup2001isoproposal-15">[15]</a><a href="#cite_note-ferguson-kohno-schneier2010cryptoengineering-8">[8]</a>

<ul><li>Key generation: As above.</li>

<li>Encapsulation for a public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}=n}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}=n}</annotation>

</semantics>

</math><img src="./419b21283eaea2e0d806285d09831c4ff1bbca7b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:6.751ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}=n}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}">

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./97dffd1729f2fde6f7db7e6801f076fa1549e189.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:19.236ex; height:2.843ex;" alt="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy">:</li></ul>

<ol><li>Choose an integer <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r}</annotation>

</semantics>

</math><img src="./0d1ecb613aa2984f0576f70f86650b7c2a132538.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.049ex; height:1.676ex;" alt="{\displaystyle r}" loading="lazy"> with <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 0\leq r<n}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 0\leq r<n}</annotation>

</semantics>

</math><img src="./7ba223befaf10cf81c9d56afef11b52ab73f81c9.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.505ex; width:9.803ex; height:2.343ex;" alt="{\displaystyle 0\leq r<n}" loading="lazy"> uniformly at random.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k:=H(r)}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k:=H(r)}</annotation>

</semantics>

</math><img src="./89c91b7600e6a520180bed66392442787de51555.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.878ex; height:2.843ex;" alt="{\displaystyle k:=H(r)}" loading="lazy"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=r^{e}{\bmod {n}}}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=r^{e}{\bmod {n}}}</annotation>

</semantics>

</math><img src="./1e0232243688f96e5ad87690961b2162434035b1.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:13.875ex; height:2.343ex;" alt="{\displaystyle c:=r^{e}{\bmod {n}}}" loading="lazy"> as its encapsulation.</li></ol>

<ul><li>Decapsulation of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> with private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}=(n,d)}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}=(n,d)}</annotation>

</semantics>

</math><img src="./c0df04bb29a3e6e13f5df0eb45ca44aec498a0e0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:10.573ex; height:2.843ex;" alt="{\displaystyle {\mathit {sk}}=(n,d)}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}">

<msup>

</msup>

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./a52f9a280661946e980d640ad3546137b90b564c.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.492ex; height:3.009ex;" alt="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy">:</li></ul>

<ol><li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r':=(c')^{d}{\bmod {n}}}">

<msup>

</msup>

<msup>

</msup>

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r':=(c')^{d}{\bmod {n}}}</annotation>

</semantics>

</math><img src="./4e8c1e6dac48cbeef26c7e58c90347b573fc70a7.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:17.147ex; height:3.176ex;" alt="{\displaystyle r':=(c')^{d}{\bmod {n}}}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k':=H(r')}">

<msup>

</msup>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=H(r')}</annotation>

</semantics>

</math><img src="./40a956efc5100e87887b3791e120967c859519d7.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.248ex; height:3.009ex;" alt="{\displaystyle k':=H(r')}" loading="lazy">.</li></ol>

This approach is simpler to implement, and provides a tighter reduction to the <a href="RSA_problem" title="RSA problem">RSA problem</a>, than padding schemes like <a href="Optimal_asymmetric_encryption_padding" title="Optimal asymmetric encryption padding">RSAES-OAEP</a>.<a href="#cite_note-shoup2001isoproposal-15">[15]</a>

<div class="mw-heading mw-heading3"><h3 id="Elgamal">Elgamal</h3></div>

Traditional <a href="Elgamal_encryption" class="mw-redirect" title="Elgamal encryption">Elgamal encryption</a> is defined over a multiplicative subgroup of the finite field <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \mathbb {Z} /p\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \mathbb {Z} /p\mathbb {Z} }</annotation>

</semantics>

</math><img src="./57869a3a3c4c431cc49c4c7ab1d9c7ea692b517b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.433ex; height:2.843ex;" alt="{\displaystyle \mathbb {Z} /p\mathbb {Z} }" loading="lazy"> with generator <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle g}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle g}</annotation>

</semantics>

</math><img src="./d3556280e66fe2c0d0140df20935a6f057381d77.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.116ex; height:2.009ex;" alt="{\displaystyle g}" loading="lazy"> of order <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle q}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle q}</annotation>

</semantics>

</math><img src="./06809d64fa7c817ffc7e323f85997f783dbdf71d.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.07ex; height:2.009ex;" alt="{\displaystyle q}" loading="lazy"> as follows:<a href="#cite_note-galbraith2012mathpkcbook-elgamal-29">[29]</a><a href="#cite_note-elgamal1985pke-30">[30]</a>

<ul><li>Key generation, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (pk,sk):=\operatorname {Gen} ()}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (pk,sk):=\operatorname {Gen} ()}</annotation>

</semantics>

</math><img src="./f7bd1324e18d4275113c98a52963c8c5055cd628.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:17.229ex; height:2.843ex;" alt="{\displaystyle (pk,sk):=\operatorname {Gen} ()}" loading="lazy">:</li></ul>

<ol><li>Choose <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle x\in \mathbb {Z} /q\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle x\in \mathbb {Z} /q\mathbb {Z} }</annotation>

</semantics>

</math><img src="./140640cbb0ffa24a2b6b92944118bd0d7a94417f.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.503ex; height:2.843ex;" alt="{\displaystyle x\in \mathbb {Z} /q\mathbb {Z} }" loading="lazy"> uniformly at random.</li>

<li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle y:=g^{x}{\bmod {p}}}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle y:=g^{x}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./1ba9b3aa3b479fc369aec9ac1b6f9e2418c6ea99.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:14.042ex; height:2.676ex;" alt="{\displaystyle y:=g^{x}{\bmod {p}}}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}:=x}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}:=x}</annotation>

</semantics>

</math><img src="./c375c4dcb47314079a5347820ddb9f5dc83d16da.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:7.096ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}:=x}" loading="lazy"> as the private key and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}:=y}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}:=y}</annotation>

</semantics>

</math><img src="./0a0b986c72b856bfe16fad2a40c47edd66761a1e.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:7.158ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}:=y}" loading="lazy"> as the public key.</li></ol>

<ul><li>Encryption of a message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m\in \mathbb {Z} /p\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m\in \mathbb {Z} /p\mathbb {Z} }</annotation>

</semantics>

</math><img src="./3a45d398f5261fbba6fe1aa6c15fdf4533ced50f.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:10.314ex; height:2.843ex;" alt="{\displaystyle m\in \mathbb {Z} /p\mathbb {Z} }" loading="lazy"> to public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}=y}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}=y}</annotation>

</semantics>

</math><img src="./154606adab86dc81f60ec28679b1f5aa30c6c29a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:6.512ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}=y}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}">

<mi>Encrypt</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}</annotation>

</semantics>

</math><img src="./acba1309d5336b8332452c3606b0341a74750802.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.137ex; height:2.843ex;" alt="{\displaystyle c:=\operatorname {Encrypt} ({\mathit {pk}},m)}" loading="lazy">:</li></ul>

<ol><li>Choose <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }</annotation>

</semantics>

</math><img src="./5ea4ad964bed4bd1fa9758edecc191199a4116cc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.222ex; height:2.843ex;" alt="{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }" loading="lazy"> uniformly at random.</li>

<li>Compute: <math display="block" xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\begin{aligned}t&:=y^{r}{\bmod {p}}\\c_{1}&:=g^{r}{\bmod {p}}\\c_{2}&:=(t\cdot m){\bmod {p}}\end{aligned}}}">

<mtr>

<mtd>

</mtd>

<mtd>

<msup>

</mrow>

</msup>

</mrow>

</mtd>

</mtr>

<mtr>

<mtd>

<msub>

</mrow>

</msub>

</mtd>

<mtd>

<msup>

</mrow>

</msup>

</mrow>

</mtd>

</mtr>

<mtr>

<mtd>

<msub>

</mrow>

</msub>

</mtd>

<mtd>

</mrow>

</mtd>

</mtr>

</mtable>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\begin{aligned}t&:=y^{r}{\bmod {p}}\\c_{1}&:=g^{r}{\bmod {p}}\\c_{2}&:=(t\cdot m){\bmod {p}}\end{aligned}}}</annotation>

</semantics>

</math></li>

<li>Return the ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=(c_{1},c_{2})}">

<msub>

</mrow>

</msub>

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=(c_{1},c_{2})}</annotation>

</semantics>

</math><img src="./3d7f7461d67a71d5e290eac1cf8882c480746629.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.718ex; height:2.843ex;" alt="{\displaystyle c:=(c_{1},c_{2})}" loading="lazy">.</li></ol>

<ul><li>Decryption of a ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'=(c'_{1},c'_{2})}">

<msup>

</msup>

</mrow>

</msubsup>

</mrow>

</msubsup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'=(c'_{1},c'_{2})}</annotation>

</semantics>

</math><img src="./c1ce574c5116fc2a5576ee6554db487c530a8a6a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:11.755ex; height:3.176ex;" alt="{\displaystyle c'=(c'_{1},c'_{2})}" loading="lazy"> for a private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}=x}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}=x}</annotation>

</semantics>

</math><img src="./be6ad3ee52193b96a7fb624bafb5e84be678c236.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:6.449ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}=x}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}">

<msup>

</msup>

<mi>Decrypt</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./3ec6570c8ffbbddb6f6b779b83f4554d82a79217.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:21.203ex; height:3.009ex;" alt="{\displaystyle m':=\operatorname {Decrypt} ({\mathit {sk}},c')}" loading="lazy">:</li></ul>

<ol><li>Fail and return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \bot }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \bot }</annotation>

</semantics>

</math><img src="./f282c7bc331cc3bfcf1c57f1452cc23c022f58de.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.808ex; height:2.176ex;" alt="{\displaystyle \bot }" loading="lazy"> if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (c'_{1})^{(p-1)/q}\not \equiv 1{\pmod {p}}}">

</mrow>

</msubsup>

<msup>

</mrow>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (c'_{1})^{(p-1)/q}\not \equiv 1{\pmod {p}}}</annotation>

</semantics>

</math><img src="./5b9fbace7f9f0f833261144e12b507bbf1394929.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:25.003ex; height:3.509ex;" alt="{\displaystyle (c'_{1})^{(p-1)/q}\not \equiv 1{\pmod {p}}}" loading="lazy"> or if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (c'_{2})^{(p-1)/q}\not \equiv 1{\pmod {p}}}">

</mrow>

</msubsup>

<msup>

</mrow>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (c'_{2})^{(p-1)/q}\not \equiv 1{\pmod {p}}}</annotation>

</semantics>

</math><img src="./3b968ee605b7ac7f7af3d02897db11073a379fb6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:25.003ex; height:3.509ex;" alt="{\displaystyle (c'_{2})^{(p-1)/q}\not \equiv 1{\pmod {p}}}" loading="lazy">, i.e., if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'_{1}}">

</mrow>

</msubsup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'_{1}}</annotation>

</semantics>

</math><img src="./cb6b9cd109a342a7283edb5e0bd729beedc3b804.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:2.061ex; height:2.843ex;" alt="{\displaystyle c'_{1}}" loading="lazy"> or <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'_{2}}">

</mrow>

</msubsup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'_{2}}</annotation>

</semantics>

</math><img src="./1989187655d3a06c355d467b92ec07b31438b949.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:2.061ex; height:2.843ex;" alt="{\displaystyle c'_{2}}" loading="lazy"> is not in the subgroup generated by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle g}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle g}</annotation>

</semantics>

</math><img src="./d3556280e66fe2c0d0140df20935a6f057381d77.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.116ex; height:2.009ex;" alt="{\displaystyle g}" loading="lazy">.</li>

<li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t':=(c'_{1})^{x}{\bmod {p}}}">

<msup>

</msup>

</mrow>

</msubsup>

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t':=(c'_{1})^{x}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./3ff4780d4a63193cad769d84152f9b2d37d409d5.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:17.163ex; height:3.176ex;" alt="{\displaystyle t':=(c'_{1})^{x}{\bmod {p}}}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m':=t^{-1}c'_{2}{\bmod {p}}}">

<msup>

</msup>

<msup>

</mrow>

</msup>

</mrow>

</msubsup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m':=t^{-1}c'_{2}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./869ff76d3dbfcb655d6d1a459d3d804451530ca2.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.005ex; width:18.555ex; height:3.343ex;" alt="{\displaystyle m':=t^{-1}c'_{2}{\bmod {p}}}" loading="lazy">.</li></ol>

This meets the syntax of a public-key encryption scheme, restricted to messages in the space <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \mathbb {Z} /p\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \mathbb {Z} /p\mathbb {Z} }</annotation>

</semantics>

</math><img src="./57869a3a3c4c431cc49c4c7ab1d9c7ea692b517b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.433ex; height:2.843ex;" alt="{\displaystyle \mathbb {Z} /p\mathbb {Z} }" loading="lazy"> (which limits it to message of a few hundred bytes for typical values of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle p}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle p}</annotation>

</semantics>

</math><img src="./81eac1e205430d1f40810df36a0edffdc367af36.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-left: -0.089ex; width:1.259ex; height:2.009ex;" alt="{\displaystyle p}" loading="lazy">).

By validating ciphertexts in decryption, it avoids leaking bits of the private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle x}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle x}</annotation>

</semantics>

</math><img src="./87f9e315fd7e2ba406057a97300593c4802b53e4.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.33ex; height:1.676ex;" alt="{\displaystyle x}" loading="lazy"> through maliciously chosen ciphertexts outside the group generated by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle g}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle g}</annotation>

</semantics>

</math><img src="./d3556280e66fe2c0d0140df20935a6f057381d77.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.116ex; height:2.009ex;" alt="{\displaystyle g}" loading="lazy">.

However, this fails to achieve <a href="Ciphertext_indistinguishability" title="Ciphertext indistinguishability">indistinguishability against chosen-ciphertext attack</a>.

For example, an adversary having a ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c=(c_{1},c_{2})}">

<msub>

</mrow>

</msub>

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c=(c_{1},c_{2})}</annotation>

</semantics>

</math><img src="./5fc035910d550e0cb7f84d2061d7b844423e6239.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.071ex; height:2.843ex;" alt="{\displaystyle c=(c_{1},c_{2})}" loading="lazy"> for an unknown message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> can trivially decrypt it by querying the decryption oracle for the distinct ciphertext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c':=(c_{1},c_{2}g)}">

<msup>

</msup>

<msub>

</mrow>

</msub>

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c':=(c_{1},c_{2}g)}</annotation>

</semantics>

</math><img src="./cda27d4a425e0b79f14a255b5719178e426ce898.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:13.518ex; height:3.009ex;" alt="{\displaystyle c':=(c_{1},c_{2}g)}" loading="lazy">, yielding the related plaintext <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m':=mg{\bmod {p}}}">

<msup>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m':=mg{\bmod {p}}}</annotation>

</semantics>

</math><img src="./a5d74f1d10f23779af4188f46a8bbbafe04c799e.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:16.477ex; height:2.843ex;" alt="{\displaystyle m':=mg{\bmod {p}}}" loading="lazy">, from which <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> can be recovered by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m=m'g^{-1}{\bmod {p}}}">

<msup>

</msup>

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m=m'g^{-1}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./dbfc37c020a355c4f5c77570972e2f491a38215e.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:18.166ex; height:3.009ex;" alt="{\displaystyle m=m'g^{-1}{\bmod {p}}}" loading="lazy">.<a href="#cite_note-galbraith2012mathpkcbook-elgamal-29">[29]</a>

Traditional Elgamal encryption can be adapted to the elliptic-curve setting, but it requires some way to reversibly encode messages as points on the curve, which is less trivial than encoding messages as integers mod <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle p}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle p}</annotation>

</semantics>

</math><img src="./81eac1e205430d1f40810df36a0edffdc367af36.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; margin-left: -0.089ex; width:1.259ex; height:2.009ex;" alt="{\displaystyle p}" loading="lazy">.<a href="#cite_note-koblitz1987ecc-31">[31]</a>

Since the message <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> is almost always a short secret key for a <a href="Symmetric-key" class="mw-redirect" title="Symmetric-key">symmetric-key</a> <a href="Authenticated_encryption" title="Authenticated encryption">authenticated cipher</a> used to encrypt an arbitrary bit string message, a simpler approach is to derive the secret key from <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t}</annotation>

</semantics>

</math><img src="./65658b7b223af9e1acc877d848888ecdb4466560.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.84ex; height:2.009ex;" alt="{\displaystyle t}" loading="lazy"> and dispense with <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle m}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle m}</annotation>

</semantics>

</math><img src="./0a07d98bb302f3856cbabc47b2b9016692e3f7bc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.04ex; height:1.676ex;" alt="{\displaystyle m}" loading="lazy"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c_{2}}">

<msub>

</mrow>

</msub>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c_{2}}</annotation>

</semantics>

</math><img src="./0b30ba1b247fb8d334580cec68561e749d24aff2.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:2.061ex; height:2.009ex;" alt="{\displaystyle c_{2}}" loading="lazy"> altogether, as a KEM, using a <a href="Key_derivation_function" title="Key derivation function">key derivation function</a> <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle H}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle H}</annotation>

</semantics>

</math><img src="./75a9edddcca2f782014371f75dca39d7e13a9c1b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:2.064ex; height:2.176ex;" alt="{\displaystyle H}" loading="lazy">:<a href="#cite_note-galbraith2012mathpkcbook-kemdem-1">[1]</a>

<ul><li>Key generation: As above.</li>

<li>Encapsulation for a public key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {pk}}=y}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {pk}}=y}</annotation>

</semantics>

</math><img src="./154606adab86dc81f60ec28679b1f5aa30c6c29a.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:6.512ex; height:2.509ex;" alt="{\displaystyle {\mathit {pk}}=y}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}">

<mi>Encap</mi>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}</annotation>

</semantics>

</math><img src="./97dffd1729f2fde6f7db7e6801f076fa1549e189.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:19.236ex; height:2.843ex;" alt="{\displaystyle (k,c):=\operatorname {Encap} ({\mathit {pk}})}" loading="lazy">:</li></ul>

<ol><li>Choose <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }</annotation>

</semantics>

</math><img src="./5ea4ad964bed4bd1fa9758edecc191199a4116cc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.222ex; height:2.843ex;" alt="{\displaystyle r\in \mathbb {Z} /q\mathbb {Z} }" loading="lazy"> uniformly at random.</li>

<li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t:=y^{r}{\bmod {p}}}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t:=y^{r}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./9a5f66c8c1333b85c59f56210db0c9e82dc31399.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:13.57ex; height:2.676ex;" alt="{\displaystyle t:=y^{r}{\bmod {p}}}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k:=H(t)}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k:=H(t)}</annotation>

</semantics>

</math><img src="./8896cab511686e4d43f0a759fcce668128e5bb27.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.669ex; height:2.843ex;" alt="{\displaystyle k:=H(t)}" loading="lazy"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c:=g^{r}{\bmod {p}}}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c:=g^{r}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./36d8b31b9d47ae9e4e037a0659643a12b8342679.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:13.695ex; height:2.676ex;" alt="{\displaystyle c:=g^{r}{\bmod {p}}}" loading="lazy"> as its encapsulation.</li></ol>

<ul><li>Decapsulation of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> with private key <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathit {sk}}=x}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathit {sk}}=x}</annotation>

</semantics>

</math><img src="./be6ad3ee52193b96a7fb624bafb5e84be678c236.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:6.449ex; height:2.176ex;" alt="{\displaystyle {\mathit {sk}}=x}" loading="lazy">, giving <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}">

<msup>

</msup>

<mi>Decap</mi>

</mrow>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}</annotation>

</semantics>

</math><img src="./a52f9a280661946e980d640ad3546137b90b564c.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:18.492ex; height:3.009ex;" alt="{\displaystyle k':=\operatorname {Decap} ({\mathit {sk}},c')}" loading="lazy">:</li></ul>

<ol><li>Fail and return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \bot }">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \bot }</annotation>

</semantics>

</math><img src="./f282c7bc331cc3bfcf1c57f1452cc23c022f58de.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.808ex; height:2.176ex;" alt="{\displaystyle \bot }" loading="lazy"> if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle (c')^{(p-1)/q}\not \equiv 1{\pmod {p}}}">

<msup>

</msup>

<msup>

</mrow>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle (c')^{(p-1)/q}\not \equiv 1{\pmod {p}}}</annotation>

</semantics>

</math><img src="./910fcd3d5b5153755d3c34ae097fd0a365bbe8df.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:24.634ex; height:3.343ex;" alt="{\displaystyle (c')^{(p-1)/q}\not \equiv 1{\pmod {p}}}" loading="lazy">, i.e., if <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle c'}">

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle c'}</annotation>

</semantics>

</math><img src="./f295e32663780aa8800e3106dba9d6e04e57cdc6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.692ex; height:2.509ex;" alt="{\displaystyle c'}" loading="lazy"> is not in the subgroup generated by <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle g}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle g}</annotation>

</semantics>

</math><img src="./d3556280e66fe2c0d0140df20935a6f057381d77.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.671ex; width:1.116ex; height:2.009ex;" alt="{\displaystyle g}" loading="lazy">.</li>

<li>Compute <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle t':=(c')^{x}{\bmod {p}}}">

<msup>

</msup>

<msup>

</msup>

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle t':=(c')^{x}{\bmod {p}}}</annotation>

</semantics>

</math><img src="./79a304464bb8604a689c62a4eec0eb4d3553e3c4.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:16.794ex; height:3.009ex;" alt="{\displaystyle t':=(c')^{x}{\bmod {p}}}" loading="lazy">.</li>

<li>Return <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle k':=H(t')}">

<msup>

</msup>

<msup>

</msup>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle k':=H(t')}</annotation>

</semantics>

</math><img src="./b7c631a3af5abf18bd803fe72eb4c4649d1fbb45.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:11.039ex; height:3.009ex;" alt="{\displaystyle k':=H(t')}" loading="lazy">.</li></ol>

When combined with an authenticated cipher to encrypt arbitrary bit string messages, the combination is essentially the <a href="Integrated_Encryption_Scheme" title="Integrated Encryption Scheme">Integrated Encryption Scheme</a>.

Since this KEM only requires a one-way key derivation function to hash random elements of the group it is defined over, <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \mathbb {Z} /p\mathbb {Z} }">

</mrow>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \mathbb {Z} /p\mathbb {Z} }</annotation>

</semantics>

</math><img src="./57869a3a3c4c431cc49c4c7ab1d9c7ea692b517b.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:5.433ex; height:2.843ex;" alt="{\displaystyle \mathbb {Z} /p\mathbb {Z} }" loading="lazy"> in this case, and not a reversible encoding of messages, it is easy to extend to more compact and efficient elliptic curve groups for the same security, as in the <a href="Integrated_Encryption_Scheme#Formal_description_of_ECIES" title="Integrated Encryption Scheme">ECIES, Elliptic Curve Integrated Encryption Scheme</a>.

<li><a href="Optimal_Asymmetric_Encryption_Padding" class="mw-redirect" title="Optimal Asymmetric Encryption Padding">Optimal Asymmetric Encryption Padding</a></li>

<li><a href="Hybrid_cryptosystem" title="Hybrid cryptosystem">Hybrid Cryptosystem</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-galbraith2012mathpkcbook-kemdem-1">^ <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-0">a</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-1">b</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-2">c</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-3">d</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-4">e</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-5">f</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-6">g</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-7">h</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-8">i</a> <a href="#cite_ref-galbraith2012mathpkcbook-kemdem_1-9">j</a> <cite id="CITEREFGalbraith2012" class="citation book cs1">Galbraith, Steven (2012). "§23.1.1: The KEM/DEM paradigm". Mathematics of Public-Key Cryptography. Cambridge University Press. pp. 471–478. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-107-01392-6</bdi>.</cite>

</li>

<li id="cite_note-shoup2000hashhedgecca-2">^ <a href="#cite_ref-shoup2000hashhedgecca_2-0">a</a> <a href="#cite_ref-shoup2000hashhedgecca_2-1">b</a> <a href="#cite_ref-shoup2000hashhedgecca_2-2">c</a> <a href="#cite_ref-shoup2000hashhedgecca_2-3">d</a> <a href="#cite_ref-shoup2000hashhedgecca_2-4">e</a> <a href="#cite_ref-shoup2000hashhedgecca_2-5">f</a> <a href="#cite_ref-shoup2000hashhedgecca_2-6">g</a> <a href="#cite_ref-shoup2000hashhedgecca_2-7">h</a> <a href="#cite_ref-shoup2000hashhedgecca_2-8">i</a> <a href="#cite_ref-shoup2000hashhedgecca_2-9">j</a> <cite id="CITEREFShoup2000" class="citation conference cs1"><a href="Victor_Shoup" title="Victor Shoup">Shoup, Victor</a> (May 2000). <a href="Bart_Preneel" title="Bart Preneel">Preneel, Bart</a> (ed.). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/3-540-45539-6_19">Using Hash Functions as a Hedge against Chosen Ciphertext Attack</a>. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/3-540-45539-6">Advances in Cryptology – EUROCRYPT 2000</a>. Lecture Notes in Computer Science. Vol. 1807. Bruges, Belgium: Springer. pp. 275–288. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-45539-6_19">10.1007/3-540-45539-6_19</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-67517-4</bdi>.</cite>

</li>

<li id="cite_note-cramer-shoup2003pkecca-3">^ <a href="#cite_ref-cramer-shoup2003pkecca_3-0">a</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-1">b</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-2">c</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-3">d</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-4">e</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-5">f</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-6">g</a> <a href="#cite_ref-cramer-shoup2003pkecca_3-7">h</a> <cite id="CITEREFCramerShoup2003" class="citation journal cs1"><a href="Ronald_Cramer" title="Ronald Cramer">Cramer, Ronald</a>; <a href="Victor_Shoup" title="Victor Shoup">Shoup, Victor</a> (2003). <a rel="nofollow" class="external text" href="https://epubs.siam.org/doi/10.1137/S0097539702403773">"Design and Analysis of Practical Public-Key Encryption Schemes Secure against Adaptive Chosen Ciphertext Attack"</a>. SIAM Journal on Computing. 33 (1). <a href="Society_for_Industrial_and_Applied_Mathematics" title="Society for Industrial and Applied Mathematics">Society for Industrial and Applied Mathematics</a>: 167–226. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1137%2FS0097539702403773">10.1137/S0097539702403773</a>.</cite>

</li>

<li id="cite_note-fips203-4">^ <a href="#cite_ref-fips203_4-0">a</a> <a href="#cite_ref-fips203_4-1">b</a> <a href="#cite_ref-fips203_4-2">c</a> <cite class="citation cs2"><a rel="nofollow" class="external text" href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf">FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard</a> (PDF), <a href="National_Institute_of_Standards_and_Technology" title="National Institute of Standards and Technology">NIST</a>, 2024-08-13, <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.6028%2FNIST.FIPS.203">10.6028/NIST.FIPS.203</a></cite>

</li>

<li id="cite_note-rfc9180-5">^ <a href="#cite_ref-rfc9180_5-0">a</a> <a href="#cite_ref-rfc9180_5-1">b</a> <a href="#cite_ref-rfc9180_5-2">c</a> <a href="#cite_ref-rfc9180_5-3">d</a> <a href="#cite_ref-rfc9180_5-4">e</a> <a href="#cite_ref-rfc9180_5-5">f</a> <cite id="CITEREFR._BarnesK._BhargavanB._LippC._Wood2022" class="citation cs1">R. Barnes; K. Bhargavan; B. Lipp; C. Wood (February 2022). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc9180">Hybrid Public Key Encryption</a>. <a href="Internet_Research_Task_Force" title="Internet Research Task Force">Internet Research Task Force</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.17487%2FRFC9180">10.17487/RFC9180</a>. <a href="Request_for_Comments" title="Request for Comments">RFC</a> <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc9180">9180</a>.</cite> Informational.

</li>

<li id="cite_note-rfc8017-6"><a href="#cite_ref-rfc8017_6-0">^</a> <cite id="CITEREFB._KaliskiA._RuschJ._JohnssonA._Rusch2016" class="citation cs1">B. Kaliski; A. Rusch; J. Johnsson; A. Rusch (November 2016). K. Moriarty (ed.). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc8017">PKCS #1: RSA Cryptography Specifications Version 2.2</a>. <a href="Internet_Engineering_Task_Force" title="Internet Engineering Task Force">Internet Engineering Task Force</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.17487%2FRFC8017">10.17487/RFC8017</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/2070-1721">2070-1721</a>. <a href="Request_for_Comments" title="Request for Comments">RFC</a> <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc8017">8017</a>.</cite> Informational. Obsoletes RFC <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc3447">3447</a>.

</li>

<li id="cite_note-menezes-vanoorschoot-vanstone1996hac-7"><a href="#cite_ref-menezes-vanoorschoot-vanstone1996hac_7-0">^</a> <cite id="CITEREFMenezesvan_OorschotVanstone1996" class="citation book cs1"><a href="Alfred_Menezes" title="Alfred Menezes">Menezes, Alfred J.</a>; <a href="Paul_van_Oorschot" title="Paul van Oorschot">van Oorschot, Paul C.</a>; <a href="Scott_Vanstone" title="Scott Vanstone">Vanstone, Scott A.</a> (October 1996). <a rel="nofollow" class="external text" href="https://cacr.uwaterloo.ca/hac/about/chap8.pdf#page=2">"8. Public-Key Encryption"</a> (PDF). <a rel="nofollow" class="external text" href="https://cacr.uwaterloo.ca/hac/">Handbook of Applied Cryptography</a>. CRC Press. pp. 283–319. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>0-8493-8523-7</bdi>.</cite>

</li>

<li id="cite_note-ferguson-kohno-schneier2010cryptoengineering-8">^ <a href="#cite_ref-ferguson-kohno-schneier2010cryptoengineering_8-0">a</a> <a href="#cite_ref-ferguson-kohno-schneier2010cryptoengineering_8-1">b</a> <cite id="CITEREFFergusonKohnoSchneier2010" class="citation book cs1"><a href="Niels_Ferguson" title="Niels Ferguson">Ferguson, Niels</a>; <a href="Tadayoshi_Kohno" title="Tadayoshi Kohno">Kohno, Tadayoshi</a>; <a href="Bruce_Schneier" title="Bruce Schneier">Schneier, Bruce</a> (2010). "12. RSA". Cryptography Engineering. Wiley. pp. 195–211. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-0-470-47424-2</bdi>.</cite>

</li>

<li id="cite_note-rfc4880-9"><a href="#cite_ref-rfc4880_9-0">^</a> <cite id="CITEREFJ._CallasL._DonnerhackeH._FinneyD._Shaw2007" class="citation cs1"><a href="Jon_Callas" title="Jon Callas">J. Callas</a>; L. Donnerhacke; <a href="Hal_Finney_(computer_scientist)" title="Hal Finney (computer scientist)">H. Finney</a>; D. Shaw; R. Thayer (November 2007). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc4880">OpenPGP Message Format</a>. Network Working Group. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.17487%2FRFC4880">10.17487/RFC4880</a>. <a href="Request_for_Comments" title="Request for Comments">RFC</a> <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc4880">4880</a>.</cite> Proposed Standard. Obsoletes RFC <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc1991">1991</a> and RFC <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc2440">2440</a>. Obsoleted by RFC <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc9580">9580</a>.

</li>

<li id="cite_note-nist-pqc-faqs-10">^ <a href="#cite_ref-nist-pqc-faqs_10-0">a</a> <a href="#cite_ref-nist-pqc-faqs_10-1">b</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://web.archive.org/web/20240626090150/https://csrc.nist.gov/Projects/post-quantum-cryptography/faqs">"Post-Quantum Cryptography: FAQs"</a>. <a href="National_Institute_of_Standards_and_Technology" title="National Institute of Standards and Technology">NIST</a>. 2024-07-19. Archived from <a rel="nofollow" class="external text" href="https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/faqs">the original</a> on 2024-06-26. Retrieved 2024-07-20.</cite>

</li>

<li id="cite_note-dent2002designerkem-11">^ <a href="#cite_ref-dent2002designerkem_11-0">a</a> <a href="#cite_ref-dent2002designerkem_11-1">b</a> <a href="#cite_ref-dent2002designerkem_11-2">c</a> <a href="#cite_ref-dent2002designerkem_11-3">d</a> <a href="#cite_ref-dent2002designerkem_11-4">e</a> <cite id="CITEREFDent2002" class="citation cs2">Dent, Alexander W. (2002), <a rel="nofollow" class="external text" href="https://eprint.iacr.org/2002/174">A Designer’s Guide to KEMs</a>, Cryptology ePrint Archive, <a href="International_Association_for_Cryptologic_Research" title="International Association for Cryptologic Research">IACR</a></cite>

</li>

<li id="cite_note-hofheinz-hövelmanns-kiltz2017modularfo-12">^ <a href="#cite_ref-hofheinz-hövelmanns-kiltz2017modularfo_12-0">a</a> <a href="#cite_ref-hofheinz-hövelmanns-kiltz2017modularfo_12-1">b</a> <a href="#cite_ref-hofheinz-hövelmanns-kiltz2017modularfo_12-2">c</a> <a href="#cite_ref-hofheinz-hövelmanns-kiltz2017modularfo_12-3">d</a> <cite id="CITEREFHofheinzHövelmannsKiltz2017" class="citation conference cs1">Hofheinz, Dennis; Hövelmanns, Kathrin; Kiltz, Eike (November 2017). Kalai, Yael; Reyzin, Leonid (eds.). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/978-3-319-70500-2_12">A Modular Analysis of the Fujisaki-Okamoto Transformation</a>. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/978-3-319-70500-2">Theory of Cryptography – TCC 2017</a>. Lecture Notes in Computer Science. Vol. 10677. Baltimore, MD, United States: Springer. pp. 341–371. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-319-70500-2_12">10.1007/978-3-319-70500-2_12</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-319-70499-9</bdi>.</cite>

</li>

<li id="cite_note-NIST.SP.800-227-13">^ <a href="#cite_ref-NIST.SP.800-227_13-0">a</a> <a href="#cite_ref-NIST.SP.800-227_13-1">b</a> <a href="#cite_ref-NIST.SP.800-227_13-2">c</a> <cite id="CITEREFAlagicBarkerChenDustin2025" class="citation cs2">Alagic, Gorjan; Barker, Elaine; Chen, Lily; Dustin, Moody; Robinson, Angela; Silberg, Hamilton; Waller, Noah (January 2025), <a rel="nofollow" class="external text" href="https://csrc.nist.gov/pubs/sp/800/227/ipd">SP 800-227 ipd: Recommendations for Key-Encapsulation Mechanisms</a>, Initial public draft, <a href="National_Institute_of_Standards_and_Technology" title="National Institute of Standards and Technology">NIST</a>, <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.6028%2FNIST.SP.800-227.ipd">10.6028/NIST.SP.800-227.ipd</a></cite>

</li>

<li id="cite_note-Persichetti2012thesis-14"><a href="#cite_ref-Persichetti2012thesis_14-0">^</a> <cite id="CITEREFPersichetti2012" class="citation thesis cs1">Persichetti, Edoardo (November 2012). <a rel="nofollow" class="external text" href="https://hdl.handle.net/2292/19803">Improving the Efficiency of Code-Based Cryptography</a>. Department of Mathematics (PhD thesis). University of Auckland.</cite>

</li>

<li id="cite_note-shoup2001isoproposal-15">^ <a href="#cite_ref-shoup2001isoproposal_15-0">a</a> <a href="#cite_ref-shoup2001isoproposal_15-1">b</a> <a href="#cite_ref-shoup2001isoproposal_15-2">c</a> <cite id="CITEREFShoup2001" class="citation cs2"><a href="Victor_Shoup" title="Victor Shoup">Shoup, Victor</a> (2001), <a rel="nofollow" class="external text" href="https://eprint.iacr.org/2001/112">A Proposal for an ISO Standard for Public Key Encryption (version 2.1)</a>, Cryptology ePrint Archive, <a href="International_Association_for_Cryptologic_Research" title="International Association for Cryptologic Research">IACR</a></cite>

</li>

<li id="cite_note-rfc9690-16"><a href="#cite_ref-rfc9690_16-0">^</a> <cite id="CITEREFR._HousleyS._Turner2025" class="citation cs1">R. Housley; S. Turner (February 2025). <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc9690">Use of the RSA-KEM Algorithm in the Cryptographic Message Syntax (CMS)</a>. <a href="Internet_Engineering_Task_Force" title="Internet Engineering Task Force">Internet Engineering Task Force</a>. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.17487%2FRFC9690">10.17487/RFC9690</a>. <a href="Request_for_Comments" title="Request for Comments">RFC</a> <a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc9690">9690</a>.</cite> Proposed Standard. Obsoletes RFC <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc5990">5990</a>.

</li>

<li id="cite_note-an2001pkae-17"><a href="#cite_ref-an2001pkae_17-0">^</a> <cite id="CITEREFAn2001" class="citation cs2">An, Jee Hea (2001), <a rel="nofollow" class="external text" href="https://eprint.iacr.org/2001/079">Authenticated Encryption in the Public-Key Setting: Security Notions and Analyses</a>, Cryptology ePrint Archive, <a href="International_Association_for_Cryptologic_Research" title="International Association for Cryptologic Research">IACR</a></cite>

</li>

<li id="cite_note-BDPR1998pkesecrelations-18"><a href="#cite_ref-BDPR1998pkesecrelations_18-0">^</a> <cite id="CITEREFBellareDesaiPointchevalRogaway1998" class="citation conference cs1"><a href="Mihir_Bellare" title="Mihir Bellare">Bellare, Mihir</a>; Desai, Anand; <a href="David_Pointcheval" title="David Pointcheval">Pointcheval, David</a>; <a href="Phillip_Rogaway" title="Phillip Rogaway">Rogaway, Phillip</a> (1998). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/BFb0055718">"Relations among notions of security for public-key encryption schemes"</a>. In <a href="Hugo_Krawczyk" title="Hugo Krawczyk">Krawczyk, Hugo</a> (ed.). 18th Annual International Cryptology Conference, Santa Barbara, California, USA, August 23–27, 1998, Proceedings. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/BFb0055715">Advances in Cryptology—CRYPTO '98</a>. Lecture Notes in Computer Science. Vol. 1462. Springer. pp. 26–45. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2FBFb0055718">10.1007/BFb0055718</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-64892-5</bdi>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/0302-9743">0302-9743</a>.</cite>

</li>

<li id="cite_note-2018EFAIL-19"><a href="#cite_ref-2018EFAIL_19-0">^</a> <cite id="CITEREFPoddebniakDresenMüllerIsing2018" class="citation conference cs1">Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg (August 2018). <a rel="nofollow" class="external text" href="https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak">"Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels"</a>. 27th USENIX Security Symposium (USENIX Security 18). USENIX Association. pp. 549–566. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-939133-04-5</bdi>.</cite>

</li>

<li id="cite_note-Giacon-Hauer-Poettering2018kemcombiners-20"><a href="#cite_ref-Giacon-Hauer-Poettering2018kemcombiners_20-0">^</a> <cite id="CITEREFGiaconHeuerPoettering" class="citation conference cs1">Giacon, Federico; Heuer, Felix; Poettering, Bertram. <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/978-3-319-76578-5_7">"KEM Combiners"</a>. In Abdalla, Michel; Dahab, Ricardo (eds.). 21st IACR International Conference on Practice and Theory of Public-Key Cryptography, Rio de Janeiro, Brazil, March 25-29, 2018, Proceedings, Part I. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/978-3-319-76578-5">Public-Key Cryptography – PKC 2018</a>. Lecture Notes in Computer Science. Vol. 10769. Springer. pp. 190–218. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-319-76578-5_7">10.1007/978-3-319-76578-5_7</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-319-76578-5</bdi>.</cite>

</li>

<li id="cite_note-10.1007_978-3-030-25510-7-21"><a href="#cite_ref-10.1007_978-3-030-25510-7_21-0">^</a> <cite id="CITEREFBindelBrendelFischlinGoncalves" class="citation conference cs1">Bindel, Nina; Brendel, Jacqueline; Fischlin, Marc; Goncalves, Brian; Stebila, Douglas. <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/978-3-030-25510-7_12">"Hybrid Key Encapsulation Mechanisms and Authenticated Key Exchange"</a>. In Ding, Jintai; Steinwaldt, Rainer (eds.). 10th International Conference, PQCrypto 2019, Chongqing, China, May 8–10, 2019 Revised Selected Papers. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/978-3-030-25510-7">Post-Quantum Cryptography</a>. Lecture Notes in Computer Science. Vol. 11505. Springer. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-030-25510-7">10.1007/978-3-030-25510-7</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-030-25510-7</bdi>.</cite>

</li>

<li id="cite_note-ETSI_TS_103_744_V1.1.1-22"><a href="#cite_ref-ETSI_TS_103_744_V1.1.1_22-0">^</a> <cite id="CITEREFETSI_Technical_Committee_Cyber_Security_(CYBER)2020" class="citation cs2">ETSI Technical Committee Cyber Security (CYBER) (December 2020), <a rel="nofollow" class="external text" href="https://www.etsi.org/deliver/etsi_ts/103700_103799/103744/01.01.01_60/ts_103744v010101p.pdf">Quantum-safe Hybrid Key Exchanges</a> (PDF), Technical Standards, <a href="European_Telecommunications_Standards_Institute" title="European Telecommunications Standards Institute">ETSI</a></cite>

</li>

<li id="cite_note-aumasson2018seriouscrypto-23">^ <a href="#cite_ref-aumasson2018seriouscrypto_23-0">a</a> <a href="#cite_ref-aumasson2018seriouscrypto_23-1">b</a> <a href="#cite_ref-aumasson2018seriouscrypto_23-2">c</a> <a href="#cite_ref-aumasson2018seriouscrypto_23-3">d</a> <cite id="CITEREFAumasson2018" class="citation book cs1">Aumasson, Jean-Philippe (2018). "10. RSA". Serious Cryptography: A Practical Introduction to Modern Encryption. No Starch Press. pp. 181–199. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-59327-826-7</bdi>.</cite>

</li>

<li id="cite_note-stinson2006cryptotheorypracticebook-24">^ <a href="#cite_ref-stinson2006cryptotheorypracticebook_24-0">a</a> <a href="#cite_ref-stinson2006cryptotheorypracticebook_24-1">b</a> <a href="#cite_ref-stinson2006cryptotheorypracticebook_24-2">c</a> <cite id="CITEREFStinson2006" class="citation book cs1"><a href="Doug_Stinson" title="Doug Stinson">Stinson, Douglas R.</a> (2006). "5. The RSA Cryptosystem and Factoring Integers". Cryptography Theory and Practice (3rd ed.). Chapman & Hall/CRC. pp. 161–232. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-58488-508-5</bdi>.</cite>

</li>

<li id="cite_note-rsa1978method-25"><a href="#cite_ref-rsa1978method_25-0">^</a> <cite id="CITEREFRivestShamirAdleman1978" class="citation journal cs1"><a href="Ron_Rivest" title="Ron Rivest">Rivest, R.L.</a>; <a href="Adi_Shamir" title="Adi Shamir">Shamir, A.</a>; <a href="Leonard_Adleman" title="Leonard Adleman">Adleman, L.</a> (1978-02-01). <a rel="nofollow" class="external text" href="https://people.csail.mit.edu/rivest/Rsapaper.pdf">"A method for obtaining digital signatures and public-key cryptosystems"</a> (PDF). Communications of the ACM. 21 (2). <a href="Association_for_Computing_Machinery" title="Association for Computing Machinery">ACM</a>: 120–126. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1145%2F359340.359342">10.1145/359340.359342</a>.</cite>

</li>

<li id="cite_note-svenda2016mkq-26"><a href="#cite_ref-svenda2016mkq_26-0">^</a> <cite id="CITEREFŠvendaNemecSekanKvašňovský2016" class="citation conference cs1">Švenda, Petr; Nemec, Matúš; Sekan, Peter; Kvašňovský, Rudolf; Formánek, David; Komárek, David; Matyáš, Vashek (August 2016). <a rel="nofollow" class="external text" href="https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda">The Million-Key Question—Investigating the Origins of RSA Public Keys</a>. 25th USENIX Security Symposium. Austin, TX, United States: USENIX Association. pp. 893–910. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-931971-32-4</bdi>.</cite>

</li>

<li id="cite_note-bleichenbacher1998pkcs1cca-27"><a href="#cite_ref-bleichenbacher1998pkcs1cca_27-0">^</a> <cite id="CITEREFBleichenbacher1998" class="citation conference cs1"><a href="Daniel_Bleichenbacher" title="Daniel Bleichenbacher">Bleichenbacher, Daniel</a> (August 1998). <a href="Hugo_Krawczyk" title="Hugo Krawczyk">Krawczyk, Hugo</a> (ed.). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/BFb0055716">Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1</a>. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/BFb0055715">Advances in Cryptology – CRYPTO '98</a>. Lecture Notes in Computer Science. Vol. 1462. Santa Barbara, CA, United States: Springer. pp. 1–12. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2FBFb0055716">10.1007/BFb0055716</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-64892-5</bdi>.</cite>

</li>

<li id="cite_note-coron-joye-naccache-paillier2000newpkcs1attacks-28"><a href="#cite_ref-coron-joye-naccache-paillier2000newpkcs1attacks_28-0">^</a> <cite id="CITEREFCoronJoyeNaccachePaillier2000" class="citation conference cs1">Coron, Jean-Sébastien; Joye, Marc; <a href="David_Naccache" title="David Naccache">Naccache, David</a>; Paillier, Pascal (May 2000). <a href="Bart_Preneel" title="Bart Preneel">Preneel, Bart</a> (ed.). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/3-540-45539-6_25">New Attacks on PKCS#1 v1.5 Encryption</a>. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/3-540-45539-6">Advances in Cryptology – EUROCRYPT 2000</a>. Lecture Notes in Computer Science. Vol. 1807. Bruges, Belgium: Springer. pp. 369–381. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-45539-6_25">10.1007/3-540-45539-6_25</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-67517-4</bdi>.</cite>

</li>

<li id="cite_note-galbraith2012mathpkcbook-elgamal-29">^ <a href="#cite_ref-galbraith2012mathpkcbook-elgamal_29-0">a</a> <a href="#cite_ref-galbraith2012mathpkcbook-elgamal_29-1">b</a> <cite id="CITEREFGalbraith2012" class="citation book cs1">Galbraith, Steven (2012). "§20.3: Textbook Elgamal encryption". Mathematics of Public-Key Cryptography. Cambridge University Press. pp. 471–478. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-107-01392-6</bdi>.</cite>

</li>

<li id="cite_note-elgamal1985pke-30"><a href="#cite_ref-elgamal1985pke_30-0">^</a> <cite id="CITEREFElgamal1984" class="citation conference cs1"><a href="Taher_Elgamal" title="Taher Elgamal">Elgamal, Taher</a> (August 1984). <a href="George_Blakley" title="George Blakley">Blakley, George Robert</a>; <a href="David_Chaum" title="David Chaum">Chaum, David</a> (eds.). <a rel="nofollow" class="external text" href="https://link.springer.com/chapter/10.1007/3-540-39568-7_2">A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms</a>. <a rel="nofollow" class="external text" href="https://link.springer.com/book/10.1007/3-540-39568-7">Advances in Cryptology – CRYPTO 1984</a>. Lecture Notes in Computer Science. Vol. 196. Santa Barbara, CA, United States: Springer. pp. 10–18. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F3-540-39568-7_2">10.1007/3-540-39568-7_2</a>. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-3-540-15658-1</bdi>.</cite>

</li>

<li id="cite_note-koblitz1987ecc-31"><a href="#cite_ref-koblitz1987ecc_31-0">^</a> <cite id="CITEREFKoblitz1987" class="citation journal cs1"><a href="Neal_Koblitz" title="Neal Koblitz">Koblitz, Neal</a> (January 1987). <a rel="nofollow" class="external text" href="https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf">"Elliptic Curve Cryptosystems"</a> (PDF). Mathematics of Computation. 48 (177). <a href="American_Mathematical_Society" title="American Mathematical Society">American Mathematical Society</a>: 203–209. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1090%2FS0025-5718-1987-0866109-5">10.1090/S0025-5718-1987-0866109-5</a>.</cite>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-08-08" href="https://en.wikipedia.org/wiki/?title=Key_encapsulation_mechanism&oldid=1304798084">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>