FrodoKEM: key encapsulation from learning with errors

Introduction FrodoKEM is a conservative yet practical post-quantum key encapsulation mechanism (KEM) whose security derives from cautious parameterizations of the well-studied learning with errors problem, which in turn has close connections to conjectured-hard problems on generic, "algebraically unstructured" lattices. As a key encapsulation mechanism, FrodoKEM is a three-tuple of algorithms (KeyGen, Encapsulate, Decapsulate):

KeyGen takes no inputs, requires randomness, and outputs a private key and a public key;
Encapsulate takes as input a public key, requires randomness, and outputs a ciphertext and a shared secret;
Decapsulate takes as input a ciphertext and a private key, and outputs a shared secret.

These algorithms are assembled as a two-pass protocol that allows two parties, A and B, to derive a shared secret in an interactive fashion. Assume that party A is responsible for the KeyGen and Decapsulate operations, and that party B is responsible for Encapsulate. In the first pass, after receiving or retrieving party A's public key, party B produces a ciphertext with the Encapsulate operation. In the second pass, party A uses its secret key and the ciphertext to execute the Decapsulate operation. The shared secret produced by this protocol can then be used to establish a secure communication channel using a symmetric-key algorithm.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Overview The core of FrodoKEM is a public-key encryption scheme called FrodoPKE, whose IND-CPA security is tightly related to the hardness of a corresponding learning with errors problem. Here we briefly recall the scientific lineage of these systems. See the surveys , and for further details. The seminal works of Ajtai (published in 1996) and Ajtai–Dwork (published in 1997) gave the first cryptographic constructions whose security properties followed from the conjectured worst-case hardness of various problems on point lattices in R^n. In subsequent years, these works were substantially refined and improved. Notably, in work published in 2005, Regev defined the learning with errors (LWE) problem, proved the hardness of (certain parameterizations of) LWE assuming the hardness of various worst-case lattice problems against quantum algorithms, and defined a public-key encryption scheme whose IND-CPA security is tightly related to the hardness of LWE. Later on, in work published in 2011, Lindner and Peikert gave a more efficient LWE-based public-key encryption scheme that uses a square public matrix A of dimension n with integer coefficients modulo q, instead of an oblong rectangular one. The FrodoPKE scheme described in this document is an instantiation and implementation of the Lindner–Peikert scheme with some modifications, such as: pseudorandom generation of the public matrix A from a small seed, more balanced key and ciphertext sizes, and new LWE parameters.

Chosen-Ciphertext Security FrodoKEM achieves IND-CCA security by way of a transformation of the IND-CPA-secure FrodoPKE. In work published in 1999, Fujisaki and Okamoto gave a generic transform from an IND-CPA PKE to an IND-CCA PKE, in the random-oracle model. At a high level, the Fujisaki–Okamoto (FO) transform derives encryption coins pseudorandomly, and decryption regenerates these coins to re-encrypt and check that the ciphertext is well-formed. In 2016, Targhi and Unruh gave a modification of the Fujisaki–Okamoto transform that achieves IND-CCA security in the quantum random-oracle model (QROM) by adding an extra hash. In 2017, Hofheinz, Hovelmanns, and Kiltz gave several variants of the Fujisaki–Okamoto and Targhi–Unruh transforms that in particular convert an IND-CPA-secure PKE into an IND-CCA-secure KEM, and analyzed them in both the classical and quantum random-oracle models, even for PKEs with non-zero decryption error. Jiang et al. show how to prove security of one of these variant FO transforms in the QROM without requiring the extra hash from Targhi–Unruh. FrodoKEM is constructed from FrodoPKE using a slight variant of Jiang et al.'s transform that includes additional values in hash computations to reduce the risk of multi-target attacks.

Notation We describe the symbols and abbreviations used throughout this document.

Z represents the set of integers and Z_q represents the set of integers modulo q.
⌊ x ⌉ is the rounding of x to the nearest integer. If x = y + 1/2 for some y in Z, then ⌊ x ⌉ = y + 1.
r^(i) is a 16-bit bit string.
(r^(0), r^(1), ..., r^(t-1)) is a sequence of t 16-bit bit strings r^(i).
AES128(k, a) denotes the 128-bit AES128 output under key k for a 128-bit input a.
SHAKE128(x, y) and SHAKE256(x, y) denote the y first bits of SHAKE128 and SHAKE256 (resp.) output for input x.
Matrices are represented in capitals with no italics (e.g., A and C). For an n1 * n2 matrix C, its (i,j)th coefficient (i.e., the entry in the ith row and jth column) is denoted by C[i,j], where 0 <= i < n1 and 0 <= j < n2. The transpose of matrix C is denoted by C^T.

AES128 and SHAKE are specified in and , respectively.

Parameters The FrodoKEM parameters are implicit inputs to the FrodoKEM algorithms defined in the next sections. A FrodoKEM parameter set specifies the following:

A positive integer D <= 16 that defines the modulus parameter q = 2^D.
Positive integers n, nHat specifying matrix dimensions. It holds that n, nHat ≡ 0 mod 8.
A positive integer B <= D specifying the number of bits encoded in each matrix entry.
A positive integer lenA specifying the bitlength of seeds for the generation of the matrix A.
A positive integer lensec specifying the number of bits that match the bit-security level. Valid values are 128, 192 and 256. This is used to determine the bitlength of seeds (not associated to the matrix A), of hash value outputs and of values associated to the generation of the shared secrets.
A positive integer lenSE specifying the bitlength of the seed value seedSE.
A positive integer lensalt specifying the bitlength of the value salt.
A discrete, symmetric error distribution X on Z with support given by S_X = {−d, −d+1, ..., −1, 0, 1, ..., d−1, d} for a small integer d.
A table T_X = (T_X(0), T_X(1), ..., T_X(d)) with (d+1) positive integers based on the cumulative distribution function for X.

The values for these parameters corresponding to each parameter set are given in .

Supporting Functions

Octet Encoding of Bit Strings This document follows the little-endian formatting for octet encoding of bit strings. A bit string b = (b[0], b[1], ..., b[|b|-1]) is converted to an octet string by taking bits from left to right, packing those from the least significant bit of each octet to the most significant bit, and moving to the next octet when each octet fills up. For example, the 16-bit bit string (b[0], b[1], ..., b[15]) is converted into two octets f and g (in this order) as The conversion from octet string to bit string is the reverse of this process. For FrodoKEM, it is always the case that |b| is a multiple of 8 when performing octet encoding of bit strings.

Matrix Encoding of Bit Strings We define how bit strings are encoded as mod-q integer matrices. From the FrodoKEM parameters one has that 2^B <= q. The encoding function ec() encodes an integer 0 <= val < 2^B as an element in Z_q by multiplying it by q/2^B = 2^(D-B): Using this function, the function Encode(b) encodes a given bit string b = (b[0], ..., b[l-1]) of length l = B * nHat^2 as an nHat * nHat matrix C with coefficients C[i,j] in Z_q by applying ec(·) to B-bit sub-strings sequentially and filling the matrix row by row entry-wise. The function Encode(b) is defined as follows. The corresponding decoding function Decode(C) decodes an nHat * nHat matrix C into a bit string of length l = B * nHat^2. It extracts B bits from each entry by applying the function dc(): That is, the Z_q-entry is interpreted as an integer, then divided by q/2^B and rounded. This amounts to rounding to the B most significant bits of each entry. With these definitions, it is the case that dc(ec(val)) = val for all 0 <= val < 2^B. The function Decode(C) is defined as follows.

Packing Matrices Modulo q We define packing and unpacking functions to transform matrices with entries in Z_q to bit strings and vice versa. The function Pack packs an n1 * n2 matrix C with entries C[i,j] in Z_q to an octet string by concatenating the D-bit matrix coefficients. The function Pack(C) is defined as follows. The function Unpack does the reverse of this process to transform an octet string o to an n1 * n2 matrix C with entries C[i,j] in Z_q, converting the input to a bit string, and then extracting D-bit strings and storing each as matrix coefficients C[i,j] for 0 <= i < n1 and 0 <= j < n2 (row-by-row from C[0,0] to C[n1-1, n2-1]). The function Unpack(o, n1, n2) is defined as follows:

Sampling from the Error Distribution The error distribution X used in FrodoKEM is a discrete, symmetric distribution on Z, centered at zero and with small support, which approximates a rounded continuous Gaussian distribution. The support of X is S_X = {−d, −d+1, ..., −1, 0, 1, ..., d−1, d} for a positive integer d specified by the FrodoKEM parameter set. The probabilities X(z) = X(−z) for z in S_X are given by a discrete probability density function, which is described by a table of d+1 positive integers related to the cumulative distribution function. Given a random 16-bit string r = (r[0], r[1], ..., r[15]), the function Sample(r) returns a sample e from FrodoKEM’s error distribution X via inversion sampling using a table T_X, as follows (note that T_X(d) is never accessed): T_X(i) then e = e + 1 end if end for e = (-1)^(r[0]) * e return e ]]> The output of the algorithm is a small integer in the range {-d, -d+1, ..., -1, 0, 1, ..., d-1, d}. The tables T_X corresponding to each of FrodoKEM’s parameter sets are given in . We emphasize that it is important to perform this sampling in constant time to avoid exposing timing side-channels, which is why the for-loop of the algorithm does a complete loop through the entire table T_X. Similarly, the comparison in the if-loop needs to be implemented in a constant-time manner.

Matrix Sampling from the Error Distribution We define the function SampleMatrix which samples an n1 * n2 matrix using the function Sample. Given (n1 * n2) 16-bit random strings r^(i) and the dimension values n1 and n2, SampleMatrix((r^(0), ..., r^(n1 * n2 - 1)), n1, n2) generates an n1 * n2 matrix E row-by-row from E[0,0] to E[n1-1,n2-1] by successively calling the function Sample n1 * n2 times, as follows:

Pseudorandom Matrix Generation The function Gen takes as input a seed, seedA, of length lenA=128 bits and an implicit dimension n that is fixed per parameter set, and outputs an n * n pseudorandom matrix A, where all the coefficients are in Z_q. There are two options for instantiating Gen: one based on AES128 and another based on SHAKE128. In both cases, the matrix A is generated row-by-row from A[0,0] to A[n-1,n-1].

Matrix A Generation with AES128 The algorithm for the case using AES128 is shown below. Each call to AES128 generates 8 coefficients.

Matrix A Generation with SHAKE128 The algorithm for the case using SHAKE128 is shown below. Each call to SHAKE128 generates n coefficients (i.e., a full matrix row).

FrodoKEM

Key Generation The key generation algorithm accepts no input, requires randomness, and outputs the keypair (pk, sk) = (seedA || b, s || seedA || b || S^T || pkh). Here, the matrix ST = S^T is encoded row-by-row from ST[0,0] to ST[nHat−1,n−1], where each matrix coefficient ST[i,j] is a signed integer encoded as a 16-bit string (s[0], s[1], ..., s[15]) in the little-endian byte order, i.e.

Encapsulation The encapsulation algorithm takes as input a public key pk = (seedA || b), requires randomness, and outputs a ciphertext c = (c1 || c2 || salt) and a shared secret ss.

Decapsulation The decapsulation algorithm takes as input a ciphertext c = (c1 || c2 || salt) and a secret key sk = (s || seedA || b || S^T || pkh), and outputs a shared secret ss.

FrodoKEM Variants FrodoKEM is parameterized by the pseudorandom generator (PRG) that is used for the generation of the matrix A. As explained in there are two options for PRG: AES128 and SHAKE128. In addition, FrodoKEM consists of two main variants: a "standard" variant that does not impose any restriction on the reuse of key pairs, and an "ephemeral" variant that is intended for applications in which the number of ciphertexts produced relative to any single public key is small. Concretely, the use of standard FrodoKEM is recommended for applications in which the number of ciphertexts produced for a single public key is expected to be equal or greater than 2^8. Ephemeral FrodoKEM MUST be used for applications in which that same figure is expected to be smaller than 2^8. In contrast to ephemeral FrodoKEM, standard FrodoKEM incorporates some changes to address certain multi-ciphertext attacks . Specifically, standard FrodoKEM doubles the length of the seedSE value and incorporates a public random salt value into encapsulation (see Table 2).

Parameter Sets This document specifies the following twelve parameter sets:

FrodoKEM-640-⟨PRG⟩ and eFrodoKEM-640-⟨PRG⟩, which match or exceed the brute-force security of AES128.
FrodoKEM-976-⟨PRG⟩ and eFrodoKEM-976-⟨PRG⟩, which match or exceed the brute-force security of AES192.
FrodoKEM-1344-⟨PRG⟩ and eFrodoKEM-1344-⟨PRG⟩, which match or exceed the brute-force security of AES256.

The label "eFrodoKEM" corresponds to the ephemeral variants. The options for ⟨PRG⟩ are AES or SHAKE, when either AES128 or SHAKE128 (respectively) is used for the generation of the matrix A. Thus, the first FrodoKEM variant consists of the parameter sets FrodoKEM-640-AES, FrodoKEM-976-AES and FrodoKEM-1344-AES (and their corresponding ephemeral variants). The second FrodoKEM variant consists of the parameter sets FrodoKEM-640-SHAKE, FrodoKEM-976-SHAKE and FrodoKEM-1344-SHAKE (and their corresponding ephemeral variants).

Summary of Parameters The parameter values characterizing the FrodoKEM parameter sets are listed below. Parameters for FrodoKEM.

Name	(e)FrodoKEM-640	(e)FrodoKEM-976	(e)FrodoKEM-1344	Description
D	15	16	16	Bitlength of q
q	32768	65536	65536	Power-of-two integer modulus
n	640	976	1344	Integer matrix dimension
nHat	8	8	8	Integer matrix dimension
B	2	3	4	Number of bits encoded per matrix entry
d	12	10	6	Integer defining the support of X
lenA	128	128	128	Bitlength of seeds for generation of matrix A
lensec	128	192	256	Number of bits matching the bit-security level
SHAKE	SHAKE128	SHAKE256	SHAKE256	SHAKE variant used for hashing

Additional parameters for FrodoKEM variant.

Name	FrodoKEM-640	FrodoKEM-976	FrodoKEM-1344	Description
lenSE	256	384	512	Bitlength of seedSE in FrodoKEM
lensalt	256	384	512	Bitlength of salt in FrodoKEM

Additional parameters for eFrodoKEM variant.

Name	eFrodoKEM-640	eFrodoKEM-976	eFrodoKEM-1344	Description
lenSE	128	192	256	Bitlength of seedSE in eFrodoKEM
lensalt	0	0	0	No salt in eFrodoKEM

Error distributions. Probabilities are shown for each integer value from 0 up to +-12. The last two rows correspond to Renyi's order and divergence.

Name	X_Frodo-640	X_Frodo-976	X_Frodo-1344
sigma	2.8	2.3	1.4
0	9288	11278	18286
+-1	8720	10277	14320
+-2	7216	7774	6876
+-3	5264	4882	2023
+-4	3384	2545	364
+-5	1918	1101	40
+-6	958	396	2
+-7	422	118
+-8	164	29
+-9	56	6
+-10	17	1
+-11	4
+-12	1
order	200	500	1000
divergence	0.324 x 10^-4	0.140 x 10^-4	0.264 x 10^-4

The distribution table entries T_X(i), for 0 <= i <= d, for sampling.

Table entries	FrodoKEM-640	FrodoKEM-976	FrodoKEM-1344
T_X(0)	4,643	5,638	9,142
T_X(1)	13,363	15,915	23,462
T_X(2)	20,579	23,689	30,338
T_X(3)	25,843	28,571	32,361
T_X(4)	29,227	31,116	32,725
T_X(5)	31,145	32,217	32,765
T_X(6)	32,103	32,613	32,767
T_X(7)	32,525	32,731
T_X(8)	32,689	32,760
T_X(9)	32,745	32,766
T_X(10)	32,762	32,767
T_X(11)	32,766
T_X(12)	32,767

Sizes (in bits) of inputs and outputs.

Scheme	secret key sk	public key pk	ciphertext ct	shared secret ss
FrodoKEM-640	19,888	9,616	9,752	16
eFrodoKEM-640	19,888	9,616	9,720	16
FrodoKEM-976	31,296	15,632	15,792	24
eFrodoKEM-976	31,296	15,632	15,744	24
FrodoKEM-1344	43,088	21,520	21,696	32
eFrodoKEM-1344	43,088	21,520	21,632	32

Security Considerations FrodoKEM-640, FrodoKEM-976 and FrodoKEM-1344 are designed to be post-quantum IND-CCA2 secure KEMs at the security levels of AES-128, AES-192 and AES-256, respectively. Users are recommended to use the highest possible security level that a given application allows. In particular, the designers of FrodoKEM recommend to use either FrodoKEM-976 or FrodoKEM-1344 for most applications, and limit the use of FrodoKEM-640 to applications that require short-term security. Lattice-based cryptographic schemes such as FrodoKEM are still relatively young. Therefore, it is recommended to use FrodoKEM in combination with a classical scheme (e.g., based on elliptic curves) while our confidence in the security of lattice schemes increases over time.

IANA Considerations This document has no IANA actions.