Compact Lattice-Coded (Multi-Recipient) Kyber without CLT Independence Assumption

TL;DR

This work tackles reducing communication and failure rates in lattice-based public-key encryption by packing multiple Kyber plaintexts into single ciphertexts and then coding across layers with lattice codes. It introduces P_\ell-Kyber (uncoded) for multi-plaintext packing and proves IND-CPA security under M-LWE, while ensuring cross-layer independence of decoding noise. The authors then implement lattice-coded vertical encoding (LV-Enc) and lattice packing to achieve substantial DFR reductions without relying on the CLT, and further achieve a 90% CER reduction for KYBER1024 with a Leech lattice encoder at \ell=24. A truncated variant (P_{t,\ell}-Kyber) allows fixed 256-bit plaintexts with additional CER improvements, and the approach extends naturally to multi-recipient KEM/mPKE with favorable compactness. Overall, the combination of ciphertext packing, lattice packing, MMSE quantization, and FO-based multi-recipient constructions yields significant efficiency gains for post-quantum Kyber while avoiding CLT-based noise assumptions, enabling practical deployment in multi-recipient and high-security contexts.

Abstract

This work presents a joint design of encoding and encryption procedures for public key encryptions (PKEs) and key encapsulation mechanism (KEMs) such as Kyber, without relying on the assumption of independent decoding noise components, achieving reductions in both communication overhead (CER) and decryption failure rate (DFR). Our design features two techniques: ciphertext packing and lattice packing. First, we extend the Peikert-Vaikuntanathan-Waters (PVW) method to Kyber: $\ell$ plaintexts are packed into a single ciphertext. This scheme is referred to as P$_\ell$-Kyber. We prove that the P$_\ell$-Kyber is IND-CCA secure under the M-LWE hardness assumption. We show that the decryption decoding noise entries across the $\ell$ plaintexts (also known as layers) are mutually independent. Second, we propose a cross-layer lattice encoding scheme for the P$_\ell$-Kyber, where every $\ell$ cross-layer information symbols are encoded to a lattice point. This way we obtain a \emph{coded} P$_\ell$-Kyber, where the decoding noise entries for each lattice point are mutually independent. Therefore, the DFR analysis does not require the assumption of independence among the decryption decoding noise entries. Both DFR and CER are greatly decreased thanks to ciphertext packing and lattice packing. We demonstrate that with $\ell=24$ and Leech lattice encoder, the proposed coded P$_\ell$-KYBER1024 achieves DFR $<2^{-281}$ and CER $ = 4.6$, i.e., a decrease of CER by $90\%$ compared to KYBER1024.

Figures (3)

• Figure 1: P$_\ell$-KYBER1024: distribution of $n_{0,0}^2$ from the Python code in KyberCode
• Figure 2: $\mathsf{IND}\text{-}\mathsf{CPA}$ of $\mathsf{m}\mathsf{PKE}$ and $\mathsf{IND}\text{-}\mathsf{CCA}$ of $\mathsf{m}\mathsf{KEM}$.
• Figure 3: An $\mathsf{IND}\text{-}\mathsf{CCA}$ secure $\mathsf{m}\mathsf{KEM}$ from a decomposable $\mathsf{IND}\text{-}\mathsf{CPA}$ secure $\mathsf{m}\mathsf{PKE} = (\mathsf{m}\mathsf{Setup}^{\sf p}, \mathsf{m}\mathsf{Gen}^{\sf p}, \mathsf{m}\mathsf{Enc} = (\mathsf{m}\mathsf{Enc}^{\sf i}, \mathsf{m}\mathsf{Enc}^{\sf d}), \mathsf{m}\mathsf{Ext}^{\sf p}, \mathsf{m}\mathsf{Dec})$. We include the superscript $^{\sf p}$ to make the code more readable.

Theorems & Definitions (42)

• definition thmcounterdefinition: Scalar Quantization
• definition thmcounterdefinition: MMSE Quantization
• definition thmcounterdefinition: Moment Generating Function
• definition thmcounterdefinition: Algebraic Expression of a Column Ring Vector
• definition thmcounterdefinition: Lattice
• definition thmcounterdefinition: Lattice Code
• definition thmcounterdefinition: CVP Decoder
• definition thmcounterdefinition: HS Encoder FrodoCong2022
• definition thmcounterdefinition: HS CVP Decoder FrodoCong2022
• definition thmcounterdefinition: M-LWE Problem Kyber2018