MoRo: From One-Sample Ring-LWE Rounding Key Exchange to Module-LWE IND-CCA KEM

Abstract

With the growing need for long-term secure communications in Internet-of-Things (IoT) and sensor-network environments, practical and robust post-quantum key-establishment mechanisms have become increasingly important. In this work, we revisit the ephemeral-only Ding key exchange (DKE) proposed at ACNS 2019, which is based on one-sample Ring Learning With Errors (Ring-LWE) with rounding, and the original analysis of which covers only passive security. Building on the DKE framework, we propose MoRo-KEM, a Module Learning With Errors (Module-LWE)-based key-encapsulation mechanism using rounding. First, we lift the construction from the Ring-LWE setting to the Module-LWE setting, retaining ring-level efficiency while enabling more flexible parameter choices and reducing reliance on rigid algebraic structure. Second, we replace discrete Gaussian sampling for secrets and errors with centered binomial sampling, thereby simplifying constant-time vectorized implementations while preserving the required noise behavior. Third, we extend the resulting key-exchange core to an IND-CPA-secure public-key encryption scheme and further obtain an IND-CCA-secure KEM via the Fujisaki–Okamoto transform. Finally, at security level $\mathrm{I}$, MoRo-KEM achieves a decryption failure rate of $2^{-166}$, lower than the $2^{-139}$ reported for CRYSTALS-Kyber, thus improving robustness against decryption-failure attacks. These properties make the proposed design attractive for secure key establishment among sensor nodes, edge devices, and gateways operating under constrained computation, memory, and communication budgets. Overall, our construction provides a concrete path from ephemeral key exchange to a practical IND-CCA-secure KEM instantiated over Module-LWE.

1. Introduction

1.1. Background

IoT and sensor-network environments typically consist of a large number of resource-constrained devices, such as sensor nodes, edge devices, and aggregation gateways, which operate under limited computational power, memory, bandwidth, and energy budgets. At the same time, these systems often require long-term confidentiality and authenticated key establishment, because they are widely deployed in critical application domains, including smart homes, industrial monitoring, environmental sensing, healthcare systems, and intelligent transportation. Such infrastructures may remain in operation for many years and rely on cryptographic algorithms for long-term protection. In 1976, Diffie and Hellman introduced the first practical key-exchange protocol, now known as the Diffie–Hellman key exchange [1]. This seminal work established the feasibility of public-key cryptography and fundamentally influenced the design of many subsequent cryptographic schemes and key-establishment protocols. A representative example is the ElGamal encryption scheme, which can be derived from the Diffie–Hellman framework and whose security relies on the hardness of the discrete logarithm problem. Meanwhile, today, widely deployed public-key cryptosystems include RSA, whose security is based on the presumed hardness of the integer factorization problem.

However, in 1994, Shor showed that both integer factorization and discrete logarithms can be solved in polynomial time on a sufficiently powerful quantum computer [2]. Consequently, if large-scale quantum computers become practical, the security of these conventional schemes would be fundamentally undermined. This threat has motivated the development of post-quantum cryptography (PQC), namely, cryptographic schemes that are believed to remain secure even against adversaries equipped with quantum computers.

Driven by this concern, NIST launched its PQC standardization effort and invited submissions for core public-key primitives, including public-key encryption, key exchange, and digital signatures [3]. As part of the evaluation process, candidates were required to provide both security self-evaluations and performance data. For encryption and key-establishment mechanisms, security was primarily assessed under standard notions such as Indistinguishability under Chosen-Ciphertext Attack (IND-CCA). This process has significantly accelerated the development and analysis of practical post-quantum schemes, especially lattice-based constructions, which have emerged as some of the most promising candidates for standardization and deployment.

Among the main families of lattice-based cryptography, schemes based on the Learning With Errors (LWE) problem are particularly important. The plain LWE setting offers a conservative foundation, but typically leads to relatively large public keys and ciphertexts; a representative example is Frodo [4]. To improve efficiency, algebraically structured variants such as Ring-LWE have been introduced [5], enabling more compact keys and faster polynomial arithmetic. Representative Ring-LWE-based schemes include NewHope [6] and the Ding key exchange (DKE) [7]. A further development is Module-LWE, which provides a middle ground between the stronger structure of Ring-LWE and the more conservative but less efficient plain LWE setting. This design space has proved especially attractive in practice, as exemplified by Kyber, a Module-LWE-based IND-CCA-secure key-encapsulation mechanism (KEM) [8].

Among these schemes, DKE is the most closely related to our work. DKE is a one-sample Ring-LWE-based key-exchange protocol in which the secret and error vectors are ephemeral; that is, freshly sampled for each session and not reused across different executions. This design avoids the long-term reuse of noisy secret material and supports a simple and efficient key-exchange mechanism in the passive security model. To offset the communication overhead introduced by the ephemeral setting, DKE combines Ring-LWE with a rounding-based reconciliation mechanism through the Round function, thereby achieving a practical trade-off between security and efficiency.

From the viewpoint of modern PQC deployment, however, several issues remain open. First, although Kyber achieves excellent overall efficiency, its concrete parameter sets are closely tied to number-theoretic transform (NTT)-friendly design choices, which limits flexibility in parameter selection. Second, the decryption failure rate reported for Kyber512 is larger than $2^{-143}$, and decryption failures have long been recognized as a potential attack surface in lattice-based encryption and KEM constructions. Due to the constraints imposed by NTT-friendly parameters, it remains highly challenging to construct parameter sets that simultaneously achieve both a low decryption failure rate and AES-128-bit security. Therefore, it is meaningful to investigate alternative designs that simultaneously provide greater parameter flexibility and a smaller decryption failure rate. In addition, DKE itself provides only passive security for key-exchange, rather than stronger notions such as IND-CPA security for public-key encryption (PKE) or IND-CCA security for KEMs.

These considerations motivate the present work. We revisit the one-sample Ring-LWE key-exchange with rounding and reconciliation proposed by Ding et al. [7], and extend it in two directions. First, we lift the construction from the Ring-LWE setting to the Module-LWE setting, aiming to retain high efficiency while allowing more flexible parameter choices and reducing reliance on rigid algebraic structure. Second, we show how to transform the resulting rounding-based key-exchange core into a practical IND-CCA KEM through a standard PKE → Fujisaki–Okamoto (FO) transform pipeline. In this way, our work connects an ephemeral one-sample key-exchange paradigm with the security and functionality requirements expected of modern post-quantum KEMs.

Simultaneously, the development of practical post-quantum cryptosystems suitable for IoT and sensor-network settings is an important topic within the scope of post-quantum cryptography for IoT and sensor networks. Recent work has also emphasized the importance and deployment challenges of integrating post-quantum cryptography into networking protocols, connected-device environments (e.g., VANET), and federated machine learning systems [9,10,11,12]. From this perspective, a post-quantum KEM for IoT-oriented deployment should not only provide strong security guarantees, but also support efficient and robust implementation on constrained platforms. In particular, moderate implementation complexity, efficient polynomial arithmetic, simple sampling procedures, and a low decryption failure probability are desirable for practical deployment in large-scale sensor-network systems.

These requirements directly motivate the design of MoRo-KEM. The proposed MoRo-KEM has several features that make it relevant to secure communication in IoT and sensor-network architectures. First, the Module-LWE setting provides a practical balance between security and efficiency, making it suitable for post-quantum key establishment between sensor nodes, edge devices, and gateways. Second, the use of centered binomial distributions instead of discrete Gaussian sampling, simplifies implementation and is more amenable to constant-time and vectorized software or hardware designs, which is beneficial for resource-constrained devices. Third, the reduced decryption failure probability improves the robustness and reliability of repeated key-establishment procedures. This property is particularly important in large-scale sensing systems, where even rare failures may be amplified by frequent protocol executions among many devices. Therefore, beyond its theoretical contribution, MoRo-KEM is motivated by practical security requirements arising from IoT and sensor-network deployments. These features make the proposed construction a relevant post-quantum key-establishment approach for constrained and large-scale networked environments.

Recent studies have further emphasized both the deployment relevance of post-quantum KEMs in IoT environments [13,14] and the need for careful treatment of FO-based decapsulation and decryption-failure behavior in post-quantum KEMs [15,16,17]. Moreover, the 2025 NIST fourth-round status report highlights the continuing standardization and diversification of post-quantum key-establishment mechanisms [18].

1.2. Our Contributions

In this paper, we revisit the ephemeral-only Ding key exchange (DKE) [7], a one-sample key-exchange protocol based on Ring-LWE, the original analysis of which is restricted to the passive security model. Building on DKE, we propose MoRo-KEM and make the following contributions.

• Lifting to the Module-LWE setting: We lift the original Ring-LWE-based construction to the Module-LWE setting. This preserves the implementation efficiency of ring-based instantiations while enabling more flexible choices of module rank and parameters, and it reduces reliance on rigid algebraic structure, thereby improving robustness against structure-exploiting attacks.
• Replacing discrete Gaussian sampling with centered binomial sampling: We sample the secret vector $\mathbf{s}$ and error vector $\mathbf{e}$ from a centered binomial distribution (CBD) instead of a discrete Gaussian distribution. This preserves the required noise behavior while enabling simpler constant-time and vectorized implementations.
• From key exchange to public-key encryption and IND-CCA KEM: Following the DKE paradigm, we extend the key-exchange core to an IND-CPA-secure PKE scheme. We then apply the Fujisaki–Okamoto transform [19] to obtain an IND-CCA-secure KEM.
• Reducing the decryption failure rate: The decryption failure rate of CRYSTALS-Kyber is $2^{-139}$, which is larger than $2^{-143}$, motivating concern about attacks exploiting decryption errors, such as decryption-failure attacks. In contrast, MoRo-KEM with $q=7681$ achieves a decryption failure rate of $2^{-166}$, which is significantly lower and thus improves robustness against such attacks.
  Note that the second-round submission of Kyber estimated the decryption failure rate of Kyber512 to be approximately $2^{-160}$, but this estimate was later considered overly conservative and was revised to approximately $2^{-139}$ in the third-round submission.

These properties also make MoRo-KEM relevant to post-quantum key establishment in IoT and sensor-network scenarios, where lightweight implementation and communication robustness are both important.

1.3. Organization

The rest of this paper is organized as follows. Section 2 introduces the necessary preliminaries. Section 3 introduces cryptographic constructions related to our work, including CRYSTALS-Kyber and the Ding key exchange. Section 4 presents the proposed scheme and proves its correctness. Section 5 provides the security analysis. Section 6 presents concrete parameter sets for the proposed scheme. Finally, Section 7 concludes the paper.

2. Preliminaries

2.1. Notation

We first fix the notation and symbols used throughout this paper. Let p and q be moduli with $p<q$, and let k denote the module rank. We assume that n is a power of two. Let $\eta$ denote the parameter of the centered binomial distribution. We write $\mathbb{Z}$ for the set of integers and ${\mathbb{Z}}_q=\mathbb{Z}/q\mathbb{Z}$ for the ring of integers modulo q. We define the polynomial ring $R=\mathbb{Z}\left[x\right]/(x^n+1)$ and its reduction modulo q by $R_q={\mathbb{Z}}_q\left[x\right]/(x^n+1)$. We also define ${\beta }_p=\lceil {log}_{2}p\rceil$ and ${\beta }_q=\lceil {log}_{2}q\rceil$ as the bit lengths used for compression. Let $\left|\right|·{\left|\right|}_{\infty }$ be the $l_{\infty }$-norm. In particular, for a vector $\mathbf{x}$ with polynomial components, we denote its infinity norm by ${\parallel \mathbf{x}\parallel }_{\infty }$, which is the maximum absolute value of the polynomial coefficients. We write $x\stackrel{\$}{\leftarrow }\chi$ to denote sampling from a distribution $\chi$. We use $\lfloor x\rfloor$, $\lceil x\rceil$, and $\lfloor x\rceil$ to denote the floor, ceiling, and rounding functions, respectively. Concatenation is denoted by $a\Vert b$, and $a\left[i\right]$ denotes the i-th element of an array a.

In this paper, elements of ${\mathbb{Z}}_q$ are represented by their centered representatives in $\{-{\displaystyle \frac{q-1}{2}},\dots ,{\displaystyle \frac{q-1}{2}}\}$ rather than $(0,q-1)$. Vectors are denoted by bold lowercase letters, for example, $\mathbf{a}$, and matrices by bold uppercase letters, for example, $\mathbf{A}$.

2.2. Probability Distributions

• Centered binomial distribution (CBD): For $\eta \in \mathbb{N}$, the centered binomial distribution ${\mathrm{CBD}}_{\eta }$ is defined as the distribution of the random variable ${\sum }_{i=1}^{\eta }(a_i-b_i)$, where $a_i$ and $b_i$ are independent and uniformly sampled from $\{0,1\}$. Its support is the set of integers in the interval $[-\eta ,\eta ]$.
• Uniform distribution: The uniform distribution over a finite set S is denoted by $U\left(S\right)$ and is defined as the distribution of a random variable X that takes each value in S with equal probability. Formally, if $S=\{s_1,s_2,\dots ,s_n\}$, then

  $$X\sim U\left(S\right)⟹Pr[X=s_i]={\displaystyle \frac{1}{n}},\forall i=1,\dots ,n.$$

  Let $U[a,b]$ denote the uniform distribution over the discrete set $\{a,a+1,\dots ,b\}$. A random sample from this distribution is written as $X\stackrel{\$}{\leftarrow }U[a,b]$. For example, the uniform distribution over the set $\{0,1,\dots ,q-1\}$ used in this paper is written as $X\stackrel{\$}{\leftarrow }U[0,q-1]$.

2.3. Symmetric Primitives

Let $\mathcal{B}$ denote the set of byte values. We write ${\mathcal{B}}^{\ell }$ for the set of ℓ-byte strings and $\mathcal{B}*$ for the set of byte strings of arbitrary length. Our IND-CCA KEM construction relies on the following symmetric primitives. We use a pseudorandom function (PRF),

$$\mathrm{PRF}:{\mathcal{B}}^{32}\times \mathcal{B}\to \mathcal{B}*,$$

and an extendable-output function (XOF),

$$\mathrm{XOF}:{\mathcal{B}}^{*}\times \mathcal{B}*\times \mathcal{B}*\to \mathcal{B}*.$$

We also use two hash functions,

$$\mathrm{H}:\mathcal{B}*\to {\mathcal{B}}^{32},\mathrm{G}:\mathcal{B}*\to {\mathcal{B}}^{32}\times {\mathcal{B}}^{32},$$

and a key-derivation function (KDF),

$$\mathrm{KDF}:\mathcal{B}*\to \mathcal{B}*.$$

Furthermore, for $a\in \mathcal{B}*$ and $c\in \mathbb{Z}$, we write $a+c$ to denote the subarray of a starting at the c-th byte.

2.4. Lattice Problems

• Learning With Errors (LWE) problem [20]: Let $\mathbf{A}\in {\mathbb{Z}}_q^{m\times n}$ be sampled uniformly at random, where $m,n\in {\mathbb{Z}}_{>0}$. Let $\mathbf{s}$ be a small secret vector and $\mathbf{e}$ be an error vector, sampled from an appropriate noise distribution, for example, $D_{\sigma }$. Then, the pair

  $$(\mathbf{A},\mathbf{b}=\mathbf{A}\mathbf{s}+\mathbf{e}modq)\in {\mathbb{Z}}_q^{m\times n}\times {\mathbb{Z}}_q^m$$

  is called an LWE instance. Search version of the LWE problem: Given an LWE instance $(\mathbf{A},\mathbf{b})$, recover the pair $(\mathbf{s},\mathbf{e})$. Decision version of the LWE problem: Given $(\mathbf{A},\mathbf{b})$, distinguish whether $\mathbf{b}$ is generated from an LWE instance or is sampled uniformly at random from ${\mathbb{Z}}_q^m$.

• Ring-LWE problem [5]: Let $m\ge 1$ be a power of 2, let $q\ge 2$ be an integer, and let

  $$R_q={\mathbb{Z}}_q\left[x\right]/{\Phi }_m\left(x\right),$$

  where ${\Phi }_m\left(x\right)=x^n+1$ is the m-th cyclotomic polynomial with $n=m/2$. For a secret polynomial $s\stackrel{\$}{\leftarrow }\chi$ and an error polynomial $e\stackrel{\$}{\leftarrow }\chi$, choose $a\in R_q$ uniformly at random and output

  $$(a,b=a·s+e)\in R_q\times R_q.$$

  Search version of the Ring-LWE problem: Given polynomially many samples $(a,b=a·s+e)\in R_q\times R_q$, recover the pair $(s,e)$. Decision version of the Ring-LWE problem: Given $a\in R_q$, distinguish whether $b=a·s+e\in R_q$ is generated from a Ring-LWE instance or is sampled uniformly at random from $R_q$.

• Module-LWE problem [21]: Let $R_q={\mathbb{Z}}_q\left[x\right]/(x^n+1)$, and fix integers $k,m\in \mathbb{N}$. Sample $\mathbf{A}\leftarrow U\left(R_q^{m\times k}\right)$, $\mathbf{s}\leftarrow {\chi }^k$, and $\mathbf{e}\leftarrow {\chi }^m$ independently, where $\chi$ is applied coefficient-wise to elements of $R_q$. Then, the pair

  $$(\mathbf{A},\mathbf{A}\mathbf{s}+\mathbf{e})\in R_q^{m\times k}\times R_q^m$$

  is called a Module-LWE instance. Search version of the Module-LWE problem: Given multiple samples

  $$(\mathbf{A},\mathbf{B}=\mathbf{A}\mathbf{s}+\mathbf{e})\in R_q^{m\times k}\times R_q^m,$$

  recover the pair $(\mathbf{s},\mathbf{e})$. Decision version of the Module-LWE problem: Given $\mathbf{A}\in R_q^{m\times k}$, distinguish whether $\mathbf{B}=\mathbf{A}\mathbf{s}+\mathbf{e}\in R_q^m$ is generated from a Module-LWE instance or is sampled uniformly at random from $R_q^m$.

The Module-LWE assumption, which underlies the security of the key-exchange scheme proposed in this work, states that distinguishing such samples from uniformly random elements is hard for any probabilistic polynomial-time (PPT) adversary.

3. Cryptographic Background

In this section, we review prior work on lattice-based key-exchange and encryption schemes. We first introduce the Ding key exchange (DKE) protocol [7], which is an ephemeral Ring-LWE+Rounding-based key-exchange scheme achieving passive security. We then describe several functions from DKE that are essential to our construction. We also briefly review Kyber [8], a Module-LWE-based key-encapsulation mechanism (KEM) that has been standardized by NIST for post-quantum security.

3.1. Ding Key Exchange (DKE)

In this subsection, we introduce the key functions and components of DKE [7], which are essential to our proposed construction. In particular, we review the Hint Function, Signal Function, Reconciliation Function, Rounding Function, Recovering Function, and the derivation of $\mathbf{a}$.

• Hint Function: The Hint Function indicates whether a value lies in a specified region and is defined as follows:

  $${\sigma }_0\left(x\right)=\left\{\begin{array}{cc}0,\hfill & x\in \left[-\lfloor {\displaystyle \frac{q}{4}}\rfloor ,\lfloor {\displaystyle \frac{q}{4}}\rfloor \right],\hfill \\ 1,\hfill & \mathrm{otherwise},\hfill \end{array}\right.$$

  and

  $${\sigma }_1\left(x\right)=\left\{\begin{array}{cc}0,\hfill & x\in \left[-\lfloor {\displaystyle \frac{q}{4}}\rfloor +1,\lfloor {\displaystyle \frac{q}{4}}\rfloor +1\right],\hfill \\ 1,\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

  Here, $x\in {\mathbb{Z}}_q$, and ${\sigma }_0\left(x\right),{\sigma }_1\left(x\right)\in \{0,1\}$.

• Signal Function: The Signal Function serves as an indicator used in the reconciliation procedure to determine how nearby values should be grouped. It is defined as follows. For any $y\in {\mathbb{Z}}_q$,

  $$\mathsf{Sig}\left(y\right)={\sigma }_b\left(y\right),$$

  where $b\leftarrow \{0,1\}$. If $\mathsf{Sig}\left(y\right)=1$, then y is said to lie in the outer region; otherwise, it lies in the inner region. The Signal Function is defined for integers in ${\mathbb{Z}}_q$. For $a\in R_q$, it is applied coefficient-wise to each coefficient $a_i\in {\mathbb{Z}}_q$. In this paper, the same notation $\mathsf{Sig}(·)$ is used for both the scalar and polynomial versions.

• Reconciliation Function: The Reconciliation Function is used to enable both parties to derive the same shared value. For any $x\in {\mathbb{Z}}_q$, let $w=\mathsf{Sig}\left(x\right)$. Then,

  $${\mathsf{Mod}}_2(x,w)=\left(\left(x+w·\frac{q-1}{2}modq\right)mod2\right).$$

  Here, elements of ${\mathbb{Z}}_q$ are first interpreted as integers in $\mathbb{Z}$ before the modulo-2 operation is applied.

Let $\Delta$ denote the error tolerance of ${\mathsf{Mod}}_2(·)$. Namely, for any $x,y\in {\mathbb{Z}}_q$, if ${\parallel x-y\parallel }_{\infty }\le \Delta$, then

$${\mathsf{Mod}}_2(x,w)={\mathsf{Mod}}_2(y,w),$$

where $w=\mathsf{Sig}\left(y\right)$. In DKE, the value $\Delta =q/4-2$ is used to ensure an overwhelmingly small decryption failure rate.

The Reconciliation Function is defined for integers in ${\mathbb{Z}}_q$. For $a\in R_q$, it is applied coefficient-wise to each coefficient $a_i\in {\mathbb{Z}}_q$. In this paper, the same notation ${\mathsf{Mod}}_2(·)$ is used for both the scalar and polynomial versions.

To explain its role, note that the input is first reduced modulo q and then modulo 2. Because q is odd, the modulo-q reduction may change parity only when wrap-around occurs. Such a parity mismatch can occur when one of the two compared values crosses the modulo-q boundary while the other does not. The following Signal Function $\mathsf{Sig}(·)$ prevents this by adjusting the reconciliation inputs so that both values lie in compatible regions of ${\mathbb{Z}}_q$, thereby avoiding asymmetric wrap-around.

Lemma 1.

Let $q>8$ be an odd integer. The function ${\mathsf{Mod}}_2(·)$ defined above is a robust extractor with respect to the Signal Function $\mathsf{Sig}(·)$ with error tolerance

$$\delta ={\displaystyle \frac{q}{4}}-2.$$

The proof of Lemma 1 can be found in [22].

• Rounding Function: The Rounding Function maps an element from ${\mathbb{Z}}_q$ to ${\mathbb{Z}}_p$. The function $\mathsf{Round}(x,p,q)$ is defined in Algorithm 1. Here, we assume that $x\in \mathbb{Z}$ and that $q>p>0$ are integers. The value x is a coefficient of a polynomial $a\in R_q$, and q and p are protocol parameters. For convenience, before applying $\mathsf{Round}(·)$, we convert

  $$x\in \left\{-{\displaystyle \frac{q-1}{2}},\dots ,{\displaystyle \frac{q-1}{2}}\right\}\mathrm{to}x\in \{0,\dots ,q-1\}.$$

  The Rounding Function is defined for integers in ${\mathbb{Z}}_q$. For $a\in R_q$, it is applied coefficient-wise to each coefficient $a_i\in {\mathbb{Z}}_q$. In this paper, the same notation $\mathsf{Round}(·)$ is used for both the scalar and polynomial versions.

Algorithm 1  $\mathsf{Round}(x,p,q)$

Input:  $x\in {\mathbb{Z}}_q$, $p,q$ Output:  Rounded value $x^{\prime }$ of x   1: $t\leftarrow \lfloor 2q/p\rfloor$, $k\leftarrow \lfloor x/t\rfloor$   2: if x is odd  then   3:     $x^{\prime }\leftarrow 2k+1$   4: else if x is even then   5:     $x^{\prime }\leftarrow 2k$   6: end if   7: if  $x^{\prime }=p$  then   8:     $rnd$$\stackrel{\$}{\leftarrow }U[0,1]$   9:     if $rnd=1$ then 10:         $x^{\prime }\leftarrow x^{\prime }-2$ 11:     else 12:         $x^{\prime }\leftarrow x^{\prime }+2mod(p+1)$ 13:     end if 14: end if 15: return $x^{\prime }$

• Recovering Function: The Recovering Function is the inverse of the Rounding Function and maps values from ${\mathbb{Z}}_p$ back to ${\mathbb{Z}}_q$. It is defined in Algorithm 2. Here, we assume that $x\in \mathbb{Z}$ and that $q>p>0$ are integers. The value x is a coefficient of a polynomial $a\in R_q$, and q and p are protocol parameters. For convenience, after applying $\mathsf{Recover}(·)$, we convert

  $$x\in \{0,\dots ,q-1\}\mathrm{back}\mathrm{to}x\in \left\{-{\displaystyle \frac{q-1}{2}},\dots ,{\displaystyle \frac{q-1}{2}}\right\}.$$

  The Recovering Function is defined for integers in $\mathbb{Z}$. For $a\in R_q$, it is applied coefficient-wise to each coefficient $a_i\in {\mathbb{Z}}_q$. In this paper, the same notation $\mathsf{Recover}(·)$ is used for both the scalar and polynomial versions.

Algorithm 2  $\mathsf{Recover}(x^{\prime },p,q)$

Input: $x^{\prime },p,q$ Output:  Recovered value $x^{″}$ of $x^{\prime }$   1: $t\leftarrow \lfloor q/p\rfloor$   2: if $x^{\prime }$ is odd then   3:     $x^{″}\leftarrow x^{\prime }·t+1$   4: else if $x^{\prime }$ is even then   5:     $x^{″}\leftarrow (x^{\prime }+1)·t$   6: end if   7: return $x^{″}$

The case distinction in the Round and Recover procedures is introduced to preserve the parity of the reconciliation inputs. Moreover, in the boundary case $x^{\prime }=p$, a random $\pm 2$ correction is applied to avoid parity inversion caused by modulo reduction.

• Derivation of polynomial a function: We use a 128-bit seed to generate a fresh $\mathbf{a}$. Specifically, the seed is given to a pseudorandom number generator, and each coefficient $a_i\in {\mathbb{Z}}_q$ for $i\in [1,n]$ of $\mathbf{a}\in R_q$ is derived as in Algorithm 3.

Algorithm 3  ${\mathsf{Derive}}_a\left(seed\right)$

Output:  Coefficient $a_i$ of polynomial $\mathbf{a}\in R_q$   1: $a_i\stackrel{\$}{\leftarrow }U[0,q-1]$

3.2. Kyber.CCA-KEM

Kyber [8] constructs an IND-CCA-secure KEM. It first designs an IND-CPA-secure public-key encryption (PKE) scheme and then applies the Fujisaki–Okamoto (FO) transform [19] to obtain an IND-CCA-secure KEM.

More specifically, Kyber follows the standard paradigm of constructing an IND-CCA-secure key-encapsulation mechanism (KEM) by applying the Fujisaki–Okamoto (FO) transform to an underlying IND-CPA-secure public-key encryption (PKE) scheme based on the Module Learning With Errors (Module-LWE) problem. In the context of Kyber, the algorithms $\mathsf{Enc}$ and $\mathsf{Dec}$ refer to encapsulation and decapsulation, respectively, rather than to encryption and decryption algorithms for a PKE scheme.

Algorithm 4 describes the key-generation procedure, which outputs a public key and a secret key augmented with the auxiliary values required by the FO transform. Algorithm 5 performs encapsulation by sampling a random message, deriving a shared key through a hash-based key-derivation process, and encrypting the message using the underlying IND-CPA-secure PKE. Algorithm 6 performs decapsulation by decrypting the ciphertext, recomputing the expected ciphertext, and outputting the shared key according to the FO verification rule.

Algorithm 4 Kyber.CCAKEM.KeyGen()

Output:  Public key $pk\in {\mathcal{B}}^{12·k·n/8+32}$ Output:  Secret key $sk\in {\mathcal{B}}^{24·k·n/8+96}$   1: $z\leftarrow {\mathcal{B}}^{32}$   2: $(pk,s{k}^{\prime }):=\mathrm{KyberCPAPKE}.\mathrm{KeyGen}\left(\right)$   3: $sk:=(s{k}^{\prime }\Vert pk\Vert \mathrm{H}\left(pk\right)\Vert z)$   4: return $(pk,sk)$

Algorithm 5 Kyber.CCAKEM.Enc($pk$)

Input:  Public key $pk\in {\mathcal{B}}^{12·k·n/8+32}$ Output:  Ciphertext $c\in {\mathcal{B}}^{d_u·k·n/8+d_v·n/8}$ Output:  Shared key $K\in \mathcal{B}*$   1: $m\leftarrow {\mathcal{B}}^{32}$   2: $m\leftarrow \mathrm{H}\left(m\right)$   3: $(\overline{K},r):=\mathrm{G}\left(m\right||\mathrm{H}\left(pk\right))$   4: $c:=\mathrm{KyberCPAPKE}.\mathrm{Enc}(pk,m,r)$   5: $K:=\mathrm{KDF}\left(\overline{K}\right|\left|\mathrm{H}\left(c\right)\right)$   6: return $(c,K)$

Algorithm 6 Kyber.CCAKEM.Dec($c,sk$)

Input:  Ciphertext $c\in {\mathcal{B}}^{d_u·k·n/8+d_v·n/8}$ Input:  Secret key $sk\in {\mathcal{B}}^{24k·n/8+96}$ Output:  Shared key $K\in \mathcal{B}*$   1: $pk:=sk+12·k·n/8\in {\mathcal{B}}^{12·k·n/8}$   2: $h:=sk+24·k·n/8+32\in {\mathcal{B}}^{32}$   3: $z:=sk+24·k·n/8+64$   4: $m^{\prime }:=\mathrm{KyberCPAPKE}.\mathrm{Dec}(\mathbf{s},(\mathbf{u},v))$   5: $(\overline{K^{\prime }},r^{\prime }):=\mathrm{G}(m^{\prime }\left|\right|h)$   6: $c^{\prime }:=\mathrm{KyberCPAPKE}.\mathrm{Enc}(pk,m^{\prime },r^{\prime })$   7: if $c^{\prime }=c$ then   8:     $K:=\mathrm{KDF}\left(\overline{K^{\prime }}\right|\left|\mathrm{H}\left(c\right)\right)$   9: else 10:     $K:=\mathrm{KDF}\left(z\right|\left|\mathrm{H}\right(c\left)\right)$ 11: end if 12: return K

4. Our Proposal

4.1. Design Approach

We revisit the one-sample Ring-LWE-based key-exchange scheme and propose a new construction that extends it to the Module-LWE with Rounding setting, which we abbreviate as MoRo. MoRo achieves a simple and secure key-exchange mechanism by leveraging rounding, while benefiting from the efficiency and implementation simplicity of the Module-LWE framework. In this design, the exchanged information is protected by the hardness of the Module-LWE problem, whereas the reconstruction of shared secret values is achieved through a rounding mechanism that suppresses errors. As a result, MoRo maintains high computational efficiency while offering more flexible parameter choices and greater extensibility than existing one-sample Ring-LWE schemes. Furthermore, based on this construction, we design an IND-CPA-secure public-key encryption (PKE) scheme, denoted by MoRo.CPA-PKE, and apply the Fujisaki–Okamoto (FO) transform to obtain an IND-CCA-secure key-encapsulation mechanism (KEM), denoted by MoRo.CCA-KEM. An overview of the proposed construction is shown in Figure 1. Here, ${\mathbf{a}}_{\mathbf{y}}$ denotes the $k\times 1$ column vector corresponding to the first column of ${\mathbf{A}}^{\top }$.

4.2. MoRo.CPA-PKE

Based on DKE, we construct an IND-CPA-secure public-key encryption (PKE) scheme. Unlike the original DKE setting where the secret values are ephemeral, the proposed PKE uses the secret vector as a static long-term secret key, similar to standard lattice-based PKE constructions such as Kyber. The PKE consists of three algorithms—key generation, encryption, and decryption—which are formally defined in Algorithms 7, 8, and 9, respectively. In Figure 1, Algorithm 7 (MoRo.CPA-PKE: key generation of party $\mathbf{x}$) corresponds to the upper-left part, Algorithm 8 (MoRo.CPA-PKE: encryption of party $\mathbf{y}$) corresponds to the right part, and Algorithm 9 (MoRo.CPA-PKE: decryption of party $\mathbf{x}$) corresponds to the lower-left part.

We define the encoding and decoding procedures as follows. Algorithm 10 gives the pseudocode for the function Decode. This function takes a $32\ell$-byte array $B\in {\mathcal{B}}^{32\ell }$ as input and outputs a polynomial

$$f=f_0+f_{1}X+\cdots +f_{255}{X}^{255},$$

where $n=256$ and $f_i$ belongs to $\{0,1,\dots ,2^{\ell }-1\}$. Formally, the function is defined as shown in Algorithm 10. The function Encode (Algorithm 11) is defined as the inverse of Decode.

Algorithm 7 MoRo.CPAPKE: key generation of party $\mathbf{x}$

Output:  Secret key $sk\in {\mathcal{B}}^{{\beta }_q·k·n/8}$ Output:  Public key $pk\in {\mathcal{B}}^{{\beta }_p·k·n/8+32}$   1: $d\leftarrow {\mathcal{B}}^{32}$   2: $(\rho ,\sigma ):=G\left(d\right)$   3: $N:=0$   4: for $i=0$ to $k-1$ do   5:     for $j=0$ to $k-1$ do   6:         $\widehat{\mathbf{A}}\left[i\right]\left[j\right]:=\mathsf{Parse}\left(\mathrm{XOF}(\rho ,j,i)\right)$   7:     end for   8: end for   9: for $i=0$ to $k-1$ do 10:     ${\mathbf{s}}_{\mathbf{x}}\left[i\right]:={\mathrm{CBD}}_{\eta }\left(\mathrm{PRF}(\sigma ,N)\right)$ 11:     $N:=N+1$ 12: end for 13: for $i=0$ to $k-1$ do 14:     ${\mathbf{e}}_{\mathbf{x}}\left[i\right]:={\mathrm{CBD}}_{\eta }\left(\mathrm{PRF}(\sigma ,N)\right)$ 15:     $N:=N+1$ 16: end for 17: ${\mathbf{p}}_{\mathbf{x}}:=\widehat{\mathbf{A}}·{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{e}}_{\mathbf{x}}$ 18: ${\mathbf{p}}_{\mathbf{x}}^{\prime }=\mathsf{Round}({\mathbf{p}}_{\mathbf{x}},p,q)$ 19: $pk:=({\mathsf{Encode}}_{{\beta }_p}({\mathbf{p}}_{\mathbf{x}}^{\prime }modp)\Vert \rho )$ 20: $sk:={\mathsf{Encode}}_{{\beta }_q}({\mathbf{s}}_{\mathbf{x}}modq)$ 21: return $(pk,sk)$

Algorithm 8 MoRo.CPAPKE: encryption of party $\mathbf{y}$

Input:  public key $pk\in {\mathcal{B}}^{{\beta }_p·k·n/8+32}$ Input:  message $\mathbf{m}\in {\mathcal{B}}^{32·k}$ Input:  random coin ${\sigma }^{\prime }\in {\mathcal{B}}^{32}$ Output:  ciphertext $ct\in {\mathcal{B}}^{{\beta }_p·k·n/8+n/8+{\beta }_q·k·n/8}$   1: $({\mathbf{p}}_{\mathbf{x}}^{\prime },\rho ):={\mathsf{Decode}}_{{\beta }_p}\left(pk\right)$   2: $N:=0$   3: for $i=0$ to $k-1$ do   4:     for $j=0$ to $k-1$ do   5:         ${\widehat{\mathbf{A}}}^T\left[i\right]\left[j\right]:=\mathsf{Parse}\left(\mathrm{XOF}(\rho ,i,j)\right)$   6:     end for   7: end for   8: for $i=0$ to $k-1$ do   9:     ${\mathbf{s}}_{\mathbf{y}}\left[i\right]:={\mathrm{CBD}}_{\eta }\left(\mathrm{PRF}({\sigma }^{\prime },N)\right)$ 10:     $N:=N+1$ 11: end for 12: for $i=0$ to $k-1$ do 13:     ${\mathbf{e}}_{\mathbf{y}}\left[i\right]:={\mathrm{CBD}}_{\eta }\left(\mathrm{PRF}({\sigma }^{\prime },N)\right)$ 14:     $N:=N+1$ 15: end for 16: ${\mathbf{p}}_{\mathbf{y}}:={\widehat{\mathbf{A}}}^T·{\mathbf{s}}_{\mathbf{y}}+2{\mathbf{e}}_{\mathbf{y}}$ 17: ${\mathbf{p}}_{\mathbf{y}}^{\prime }=\mathsf{Round}({\mathbf{p}}_{\mathbf{y}},p,q)$ 18: ${\mathbf{p}}_{\mathbf{x}}^{″}=\mathsf{Recover}({\mathbf{p}}_{\mathbf{x}}^{\prime },p,q)$ 19: $k_{\mathbf{y}}={\mathbf{s}}_{\mathbf{y}}^T·{\mathbf{p}}_{\mathbf{x}}^{″}$ 20: $w_{\mathbf{y}}=\mathsf{Sig}\left(k_{\mathbf{y}}\right)$ 21: $s{k}_{\mathbf{y}}={\mathsf{Mod}}_{\mathsf{2}}(k_{\mathbf{y}},w_{\mathbf{y}})$ 22: $c{t}_1:=({\mathsf{Encode}}_{{\beta }_p}({\mathbf{p}}_{\mathbf{y}}^{\prime }modp)\Vert w_{\mathbf{y}})$ 23: $h_{sk\mathbf{y}}=\mathrm{H}\left(s{k}_{\mathbf{y}}\right)$ 24: $c{t}_2:=s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+(\mathbf{m}+h_{sk\mathbf{y}}·{\mathbf{a}}_{\mathbf{y}})$ 25: $ct=(c{t}_1\Vert c{t}_2)$ 26: return $ct$

Algorithm 9 MoRo.CPAPKE: decryption of party $\mathbf{x}$

Input:  ciphertext $ct\in {\mathcal{B}}^{{\beta }_p·k·n/8+n/8+{\beta }_q·k·n/8}$ Output:  message ${\mathbf{m}}^{\prime }\in {\mathcal{B}}^{32·k}$   1: $(c{t}_1,c{t}_2):=ct$   2: $({\mathbf{p}}_{\mathbf{y}}^{\prime },w_{\mathbf{y}}):={\mathsf{Decode}}_{{\beta }_p}\left(c{t}_1\right)$   3: ${\mathbf{p}}_{\mathbf{y}}^{″}=\mathsf{Recover}({\mathbf{p}}_{\mathbf{y}}^{\prime },p,q)$   4: $k_{\mathbf{x}}={\left({\mathbf{p}}_{\mathbf{y}}^{″}\right)}^T·{\mathbf{s}}_{\mathbf{x}}$   5: $s{k}_{\mathbf{x}}={\mathsf{Mod}}_2(k_{\mathbf{x}},w_{\mathbf{y}})$   6: $h_{sk\mathbf{x}}=\mathrm{H}\left(s{k}_{\mathbf{x}}\right)$   7: ${\mathbf{m}}^{\prime }=c{t}_2-s{k}_{\mathbf{x}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }-h_{sk\mathbf{x}}·{\mathbf{a}}_{\mathbf{y}}$   8: return ${\mathbf{m}}^{\prime }$

Algorithm 10 Decode: ${\mathcal{B}}^{32\ell }\to R_q$

1: Input: Byte array $B\in {\mathcal{B}}^{32\ell }$   2: Output: Polynomial $f\in R_q$   3: $(b_0,b_1,\dots ,b_{256\ell -1}):=\mathsf{BytesToBits}\left(B\right)$   4: for $i=0$ to 255 do   5:     ${\displaystyle f_i:={\displaystyle \sum _{j=0}^{\ell -1}}{b}_{i\ell +j}·2^j}$   6: end for   7: return $f_0+f_{1}X+f_2{X}^2+\cdots +f_{255}{X}^{255}$

Algorithm 11 Encode: $R_q\to {\mathcal{B}}^{32\ell }$

1: Input: Polynomial $f=f_0+f_{1}X+\cdots +f_{255}{X}^{255}\in R_q$, where $f_i\in \{0,1,\dots ,2^{\ell }-1\}$   2: Output: Byte array $B\in {\mathcal{B}}^{32\ell }$   3: for $i=0$ to 255 do   4:     for $j=0$ to $\ell -1$ do   5:         $b_{i\ell +j}:=⌊{\displaystyle \frac{f_i}{2^j}}⌋mod2$   6:     end for   7: end for   8: $B:=\mathsf{BitsToBytes}(b_0,b_1,\dots ,b_{256\ell -1})$   9: return B

4.3. Correctness

To prove correctness, we show that if a ciphertext $\mathbf{ct}$ is generated as an encryption of a message $\mathbf{m}$, then decrypting $\mathbf{ct}$ recovers the same message, that is, ${\mathbf{m}}^{\prime }=\mathbf{m}$. Recall that

$${\mathbf{p}}_{\mathbf{x}}=\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{e}}_{\mathbf{x}},{\mathbf{p}}_{\mathbf{y}}={\mathbf{A}}^{\top }{\mathbf{s}}_{\mathbf{y}}+2{\mathbf{e}}_{\mathbf{y}}.$$

$$\begin{array}{cc}\hfill {\mathbf{k}}_{\mathbf{x}}& ={\left({\mathbf{p}}_{\mathbf{y}}^{″}\right)}^{\top }{\mathbf{s}}_{\mathbf{x}}\hfill \\ \hfill & ={\left({\mathbf{A}}^{\top }{\mathbf{s}}_{\mathbf{y}}+2{\mathbf{e}}_{\mathbf{y}}+{\mathbf{d}}_{\mathbf{y}}\right)}^{\top }{\mathbf{s}}_{\mathbf{x}}\hfill \\ \hfill & ={\mathbf{s}}_{\mathbf{y}}^{\top }\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{e}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}+{\mathbf{d}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}},\hfill \end{array}$$

(1)

and

$$\begin{array}{cc}\hfill {\mathbf{k}}_{\mathbf{y}}& ={\mathbf{s}}_{\mathbf{y}}^{\top }\left({\mathbf{p}}_{\mathbf{x}}^{″}\right)\hfill \\ \hfill & ={\mathbf{s}}_{\mathbf{y}}^{\top }\left(\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{e}}_{\mathbf{x}}+{\mathbf{d}}_{\mathbf{x}}\right)\hfill \\ \hfill & ={\mathbf{s}}_{\mathbf{y}}^{\top }\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}+{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{d}}_{\mathbf{x}}.\hfill \end{array}$$

(2)

Hence,

$${\mathbf{k}}_{\mathbf{x}}-{\mathbf{k}}_{\mathbf{y}}=2{\mathbf{e}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-2{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}+{\mathbf{d}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{d}}_{\mathbf{x}},$$

and therefore

$${∥{\mathbf{k}}_{\mathbf{x}}-{\mathbf{k}}_{\mathbf{y}}∥}_{\infty }={∥2{\mathbf{e}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-2{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}+{\mathbf{d}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{d}}_{\mathbf{x}}∥}_{\infty }.$$

By Lemma 1, the outputs of ${\mathsf{Mod}}_2$ agree whenever the difference is smaller than $q/4-2$. Accordingly, the decryption failure rate ${\delta }_{\mathrm{fail}}$ is defined as

$$\begin{array}{c}\hfill {\delta }_{\mathrm{fail}}=Pr\left[{∥2{\mathbf{e}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-2{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}+{\mathbf{d}}_{\mathbf{y}}^{\top }{\mathbf{s}}_{\mathbf{x}}-{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{d}}_{\mathbf{x}}∥}_{\infty }\ge \Delta \right].\end{array}$$

(3)

Note that the difference term in (3) consists of linear combinations of the error vectors. Since the error terms in the public values are scaled by a factor of 2, their contribution to the difference is always even. Moreover, the rounding and recovery procedures introduce additional error terms that are also distributed over even values. Therefore, the overall difference between the two reconciliation inputs remains even, and no parity inversion occurs after reduction modulo q. Consequently, both parties deterministically derive the same shared bit in $\{0,1\}$. The $\Delta$-closeness condition guarantees that the difference between the two inputs remains within the range in which this parity consistency is preserved under the adjustment introduced by $\mathsf{Sig}(·)$.

Moreover, the parity-preserving property of the reconciliation procedure follows from the discussion in Section 3.1. Here, the error tolerance is $\Delta ={\displaystyle \frac{q}{4}}-2$. If this condition is satisfied, then $s{k}_{\mathbf{x}}=s{k}_{\mathbf{y}}$ holds. Moreover, we have

$$c{t}_2=s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+\left(\mathbf{m}+h_{sk\mathbf{y}}·{\mathbf{a}}_{\mathbf{y}}\right).$$

Since $h_{sk\mathbf{x}}=h_{sk\mathbf{y}}$, it follows that

$${\mathbf{m}}^{\prime }=s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+\left(\mathbf{m}+h_{sk\mathbf{y}}·{\mathbf{a}}_y\right)-s{k}_{\mathbf{x}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }-h_{sk\mathbf{x}}·{\mathbf{a}}_{\mathbf{y}}=\mathbf{m},$$

which proves correctness.

In this setting, $\mathbf{d}$ denotes the error terms introduced by the Round and Recover functions. Let

$$t=\lceil {log}_{2}q\rceil -\lceil {log}_{2}p\rceil ,\mathbf{p}=(p_1,p_2,\dots ,p_n),{\mathbf{p}}^{″}=(p_1^{″},p_2^{″},\dots ,p_n^{″}).$$

Each element is given by

$$p_i^{″}=\mathsf{Recover}(\mathsf{Round}(p_i,p,q),p,q),$$

and the error vector is defined as $\mathbf{d}=\mathbf{p}-{\mathbf{p}}^{″}$. Each component $d_i$ takes values from

$$\{-2^t,-2^t+2,\dots ,2^t-2\},$$

and these values occur with equal probability, namely,

$$Pr[d_i=-2^t]=Pr[d_i=-2^t+2]=\cdots =Pr[d_i=2^t-2]={\displaystyle \frac{1}{2^t}}.$$

4.4. MoRo.CCA-KEM

By applying the Fujisaki–Okamoto transform to the IND-CPA-secure PKE described above, we construct an IND-CCA-secure key-encapsulation mechanism (KEM). The KEM consists of three algorithms—key generation, encapsulation, and decapsulation—which are formally defined in Algorithms 12–14. In the following, Algorithm 7, Algorithm 8, and Algorithm 9 are denoted by MoRo.CPA-PKE.KeyGen(·), MoRo.CPA-PKE.Enc(·), and MoRo.CPA-PKE.Dec(·), respectively. Although the Fujisaki–Okamoto transform is widely used to achieve IND-CCA security in practical post-quantum KEMs, it also introduces additional implementation considerations, including re-encryption overhead and verification during decapsulation [15,16]. These verification procedures require careful implementation and may introduce additional attack surfaces, including side-channel leakage. Therefore, secure deployment of FO-based constructions requires careful constant-time implementation techniques.

Algorithm 12 MoRo.CCA-KEM: key generation of party $\mathbf{x}$

Output:  secret key $sk\in {\mathcal{B}}^{{\beta }_q·k·n/8+{\beta }_p·k·n/8+32·k+64}$ Output:  public key $pk\in {\mathcal{B}}^{{\beta }_p·k·n/8+32}$   1: $\mathbf{z}\leftarrow {\mathcal{B}}^{32·k}$   2: $(pk,s{k}^{\prime }):=\mathrm{MoRo}.\mathrm{CPA}\text{-}\mathrm{PKE}.\mathrm{KeyGen}\left(\right)$   3: $sk:=\left(s{k}^{\prime }\right|\left|pk\right|\left|\mathrm{H}\left(pk\right)\right|\left|\mathbf{z}\right)$   4: return $(pk,sk)$

Algorithm 13 MoRo.CCA-KEM: encapsulation of party $\mathbf{y}$

Input:  public key $pk\in {\mathcal{B}}^{{\beta }_p·k·n/8+32}$ Output:  ciphertext $ct\in {\mathcal{B}}^{{\beta }_p·k·n/8+n/8+{\beta }_q·k·n/8}$ Output:  shared key $K\in \mathcal{B}*$   1: $\mathbf{m}\leftarrow {\mathcal{B}}^{32·k}$   2: $\mathbf{m}\leftarrow \mathrm{H}\left(\mathbf{m}\right)$   3: $(\overline{K},{\sigma }^{\prime }):=\mathrm{G}\left(\mathbf{m}\right||\mathrm{H}\left(pk\right))$   4: $ct:=\mathrm{MoRo}.\mathrm{CPA}\text{-}\mathrm{PKE}.\mathrm{Enc}(pk,\mathbf{m},{\sigma }^{\prime })$   5: $K:=\mathrm{KDF}\left(\overline{K}\right|\left|\mathrm{H}\left(ct\right)\right)$   6: return $(ct,K)$

Algorithm 14 MoRo.CCA-KEM: decapsulation of party $\mathbf{x}$

Input:  ciphertext $ct\in {\mathcal{B}}^{{\beta }_p·k·n/8+n/8+{\beta }_q·k·n/8}$ Input:  secret key $sk\in {\mathcal{B}}^{{\beta }_q·k·n/8+{\beta }_p·k·n/8+32·k+64}$ Output:  shared key $K\in \mathcal{B}*$   1: $pk:=sk+{\beta }_q·k·n/8\in {\mathcal{B}}^{{\beta }_p·k·n/8}$   2: $\mathrm{H}\left(pk\right):=sk+{\beta }_q·k·n/8+{\beta }_p·k·n/8+32\in {\mathcal{B}}^{32}$   3: $z:=sk+{\beta }_q·k·n/8+{\beta }_p·k·n/8+64$   4: ${\mathbf{m}}^{\prime }:=\mathrm{MoRo}.\mathrm{CPA}\text{-}\mathrm{PKE}.\mathrm{Dec}\left(ct\right)$   5: $(\overline{K^{\prime }},r^{\prime }):=\mathrm{G}({\mathbf{m}}^{\prime }\left|\right|\mathrm{H}\left(pk\right))$   6: $c{t}^{\prime }:=\mathrm{MoRo}.\mathrm{CPA}\text{-}\mathrm{PKE}.\mathrm{Enc}(pk,{\mathbf{m}}^{\prime },r^{\prime })$   7: if  $ct=c{t}^{\prime }$  then   8:     $K:=\mathrm{KDF}\left(\overline{K^{\prime }}\right|\left|\mathrm{H}\left(ct\right)\right)$   9: else 10:     $K:=\mathrm{KDF}\left(z\right|\left|\mathrm{H}\right(ct\left)\right)$ 11: end if

5. Security

In this section, we provide the IND-CPA security proof for the proposed public-key encryption (PKE) scheme and the IND-CCA security proof for the resulting key-encapsulation mechanism (KEM) obtained via the Fujisaki–Okamoto (FO) transform. We first introduce several lemmas used in the proofs.

Lemma 2.

In ${\mathit{Game}}_2$, we obtain two Module-LWE samples $(\mathbf{A},{\mathbf{p}}_{\mathbf{x}}={\mathbf{B}}_{\mathbf{x}})$ and $(\mathbf{A},{\mathbf{k}}_{\mathbf{y}}={\mathbf{u}}_{\mathbf{y}})$. Assume that the secret and error vectors are sampled from the centered binomial distribution (CBD), denoted by $B_{\eta }$. If ${\mathbf{p}}_{\mathbf{x}}$ is a Module-LWE instance, that is,

$${\mathbf{p}}_{\mathbf{x}}=\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{e}}_{\mathbf{x}},$$

then

$${\mathbf{k}}_{\mathbf{y}}={\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{p}}_{\mathbf{x}}={\mathbf{s}}_{\mathbf{y}}^{\top }\mathbf{A}{\mathbf{s}}_{\mathbf{x}}+2{\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}.$$

Since the coefficients of ${\mathbf{s}}_{\mathbf{y}}$ and ${\mathbf{e}}_{\mathbf{x}}$ lie in $[-\eta ,\eta ]$, each coefficient of ${\mathbf{s}}_{\mathbf{y}}^{\top }{\mathbf{e}}_{\mathbf{x}}$ is a sum of signed products of independent bounded coefficients. Let $|s_i|\le B_s$ and $|e_i|\le B_e$. Then, each summand is bounded by $B_s{B}_e$. In the case of ${\mathrm{CBD}}_{\eta }$, we may take it that $B_s=B_e=\eta$, the $B_s{B}_e$ follows a discrete distribution with expectation 0, the variance is ${\displaystyle \frac{kn{\eta }^2}{4}}$ and upper bounded by ${\eta }^2$. Note that the upper bound appears with an extremely small probability of ${\left(2^{-4\eta +1}\right)}^{kn}$, which is interpreted in Appendix A.

Lemma 3.

Let $q>2$ be a prime. For a uniformly chosen $a\stackrel{\$}{\leftarrow }{\mathbb{Z}}_q$ and $b\stackrel{\$}{\leftarrow }\{0,1\}$, let

$$w=\mathsf{Sig}\left(a\right)={\sigma }_b\left(a\right).$$

Then, the value ${\mathsf{Mod}}_2(a,w)\in \{0,1\}$ is uniformly distributed.

Proof. 

We show that for any $c\in \{0,1\}$,

$$Pr[{\mathsf{Mod}}_2(a,w)=c\mid {\sigma }_b\left(a\right)=w]={\displaystyle \frac{1}{2}},$$

where a is uniformly sampled from ${\mathbb{Z}}_q$ and b is uniformly chosen from $\{0,1\}$.

First, consider the interval where ${\sigma }_b\left(a\right)=0$, namely,

$$R+b:=[\lfloor -q/4\rfloor +b,\lfloor q/4\rfloor +b].$$

Its size is

$$|R+b|=2⌊{\displaystyle \frac{q}{4}}⌋+1.$$

Thus, for uniformly random $a\stackrel{\$}{\leftarrow }{\mathbb{Z}}_q$,

$$Pr[{\sigma }_0\left(a\right)=0]=Pr[{\sigma }_1\left(a\right)=0]={\displaystyle \frac{2\lfloor q/4\rfloor +1}{q}}.$$

Now, define two disjoint subsets of $R+b$ according to the parity of a:

$${(R+b)}_0:=\{a\in R+b\mid a\equiv 0(mod2)\},$$

$${(R+b)}_1:=\{a\in R+b\mid a\equiv 1(mod2)\}.$$

Therefore, for $c\in \{0,1\}$,

$$Pr[{\mathsf{Mod}}_2(a,0)=c\wedge {\sigma }_b\left(a\right)=0]={\displaystyle \frac{{|(R+b)}_c|}{q}}.$$

Since $|R+b|=2\lfloor q/4\rfloor +1$ is odd, we have the balanced partition

$${|(R+0)}_0{|+|(R+1)}_0{|=|(R+0)}_1{|+|(R+1)}_1|=|R+b|.$$

Hence, conditioning on ${\sigma }_b\left(a\right)=0$, we obtain

$$\begin{array}{cc}& Pr[{\mathsf{Mod}}_2(a,0)=c\mid {\sigma }_b\left(a\right)=0]\hfill \\ & ={\displaystyle \frac{Pr[{\mathsf{Mod}}_2(a,0)=c\wedge {\sigma }_b\left(a\right)=0]}{Pr[{\sigma }_b\left(a\right)=0]}}\hfill \\ & =\left({\displaystyle \frac{1}{2}}·{\displaystyle \frac{{|(R+0)}_c|}{q}}+{\displaystyle \frac{1}{2}}·{\displaystyle \frac{{|(R+1)}_c|}{q}}\right)·{\displaystyle \frac{q}{2\lfloor q/4\rfloor +1}}\hfill \\ & =\left({\displaystyle \frac{1}{2}}·{\displaystyle \frac{|R+b|}{q}}\right)·{\displaystyle \frac{q}{2\lfloor q/4\rfloor +1}}\hfill \\ & ={\displaystyle \frac{1}{2}}.\hfill \end{array}$$

Next, consider the complementary region ${\mathbb{Z}}_q\setminus (R+b)$, where ${\sigma }_b\left(a\right)=1$. Since

$$|{\mathbb{Z}}_q\setminus (R+b)|=q-(2\lfloor q/4\rfloor +1),$$

we have

$$Pr[{\sigma }_0\left(a\right)=1]=Pr[{\sigma }_1\left(a\right)=1]={\displaystyle \frac{q-(2\lfloor q/4\rfloor +1)}{q}}.$$

As this region has even size, parity is again uniformly distributed. Thus,

$$\begin{array}{cc}& Pr[{\mathsf{Mod}}_2(a,1)=c\mid {\sigma }_b\left(a\right)=1]\hfill \\ & ={\displaystyle \frac{Pr[{\mathsf{Mod}}_2(a,1)=c\wedge {\sigma }_b\left(a\right)=1]}{Pr[{\sigma }_b\left(a\right)=1]}}\hfill \\ & =\left({\displaystyle \frac{1}{2}}·{\displaystyle \frac{q-(2\lfloor q/4\rfloor +1)}{q}}\right)·{\displaystyle \frac{q}{q-(2\lfloor q/4\rfloor +1)}}\hfill \\ & ={\displaystyle \frac{1}{2}}.\hfill \end{array}$$

Combining the two cases ${\sigma }_b\left(a\right)=0$ and ${\sigma }_b\left(a\right)=1$, we conclude that ${\mathsf{Mod}}_2(a,w)$ is uniformly distributed over $\{0,1\}$.    □

Lemma 4.

The vector

$$\mathbf{p}=\mathbf{A}\mathbf{s}+2\mathbf{e}$$

can also be regarded as arising from a decisional Module-LWE instance of the form

$$\mathbf{b}=\mathbf{A}\mathbf{s}+\mathbf{e}.$$

Proof. 

We have

$$\begin{array}{cc}\hfill \mathbf{p}=\mathbf{A}\mathbf{s}+2\mathbf{e}& \iff 2^{-1}\mathbf{p}=2^{-1}\mathbf{A}\mathbf{s}+\mathbf{e}\hfill \\ & \iff {\mathbf{p}}^{\prime }={\mathbf{A}}^{\prime }\mathbf{s}+\mathbf{e},\hfill \end{array}$$

where

$${\mathbf{p}}^{\prime }=2^{-1}\mathbf{p},{\mathbf{A}}^{\prime }=2^{-1}\mathbf{A}.$$

Since $gcd(q,2)=1$, multiplication by $2^{-1}$ in ${\mathbb{Z}}_q$ is a bijection. Hence, if $\mathbf{A}$ is uniform over $R_q^{k\times k}$, then ${\mathbf{A}}^{\prime }$ is also uniform over $R_q^{k\times k}$. Therefore, $({\mathbf{A}}^{\prime },{\mathbf{p}}^{\prime })$ can be regarded as a decisional Module-LWE instance.    □

5.1. IND-CPA Security

This subsection presents a game-based proof of IND-CPA security for the proposed public-key encryption (PKE) scheme.

• Game₀:

This is the real IND-CPA experiment between the challenger and the adversary $\mathcal{A}$. The challenger generates the public parameters honestly and returns the challenge ciphertext corresponding to one of the two challenge messages. Let $S_i$ denote the event that $\mathcal{A}$ outputs the correct challenge bit in Game_i. Then, the IND-CPA advantage of $\mathcal{A}$ is

$${\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CPAPKE}}^{\mathsf{ind}-\mathsf{cpa}}\left(\mathcal{A}\right)=\left|Pr\left[S_0\right]-{\displaystyle \frac{1}{2}}\right|.$$

(4)

• Game₁:

This game is identical to Game₀, except that the secret and error vectors are generated from the centered binomial distribution (CBD) using the pseudorandom function (PRF), instead of being viewed as ideally sampled noise.

Lemma 5.

For any PPT adversary $\mathcal{A}$, there exists a PPT adversary ${\mathcal{B}}_0$ such that

$$\left|Pr\left[S_0\right]-Pr\left[S_1\right]\right|\le {\mathsf{Adv}}_{\mathrm{PRF}}\left({\mathcal{B}}_0\right).$$

Proof. 

The only difference between Game₀ and Game₁ is whether the randomness used to derive the secret and error vectors is generated by a truly random process or by the PRF. Any distinguisher between these two games therefore yields a distinguisher against the PRF with the same advantage.    □

• Game₂:

This game is identical to Game₁, except that $\mathbf{A}$ is sampled uniformly at random rather than being deterministically derived from the seed through the extendable-output function (XOF).

Lemma 6.

Assuming that the XOF is modeled as a random oracle, the distributions in Game₁ and Game₂ are identical. In particular, $Pr\left[S_1\right]=Pr\left[S_2\right]$.

Proof. 

In both games, the matrix $\mathbf{A}$ is distributed uniformly over the same domain. The only difference is whether it is obtained by explicit uniform sampling or by programming the XOF as a random oracle. Hence, the resulting distributions are identical.    □

• Game₃:

This game is identical to Game₂, except that ${\mathbf{p}}_{\mathbf{x}}$ is replaced with a uniformly random element ${\mathbf{r}}_{\mathbf{x}}$ of the same domain.

Lemma 7.

Assume that the decisional Module-LWE problem is hard. Then, for any PPT adversary $\mathcal{A}$, there exists a PPT adversary ${\mathcal{B}}_1$ such that

$$\left|Pr\left[S_2\right]-Pr\left[S_3\right]\right|\le {\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_1\right).$$

Proof. 

Given a challenge pair $(\mathbf{A},{\mathbf{B}}_{\mathbf{x}})$, where ${\mathbf{B}}_{\mathbf{x}}$ is either a valid Module-LWE sample or a uniformly random element, the reduction ${\mathcal{B}}_1$ embeds ${\mathbf{B}}_{\mathbf{x}}$ as ${\mathbf{p}}_{\mathbf{x}}$ in the public view given to $\mathcal{A}$. All remaining components are generated honestly. If ${\mathbf{B}}_{\mathbf{x}}$ is a valid Module-LWE sample, then the view of $\mathcal{A}$ is exactly that of Game₂. If ${\mathbf{B}}_{\mathbf{x}}$ is uniform, then the view of $\mathcal{A}$ is exactly that of Game₃. Therefore, any distinguisher between Game₂ and Game₃ yields a distinguisher for the decisional Module-LWE problem.    □

• Game₄:

This game is identical to Game₃, except that ${\mathbf{p}}_{\mathbf{y}}$ is replaced with a uniformly random element ${\mathbf{r}}_{\mathbf{y}}$ of the same domain.

Lemma 8.

Assume that the decisional Module-LWE problem is hard. Then, for any PPT adversary $\mathcal{A}$, there exists a PPT adversary ${\mathcal{B}}_2$ such that

$$\left|Pr\left[S_3\right]-Pr\left[S_4\right]\right|\le {\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_2\right).$$

Proof. 

The proof is analogous to that of Lemma 7. The reduction ${\mathcal{B}}_2$ receives a challenge pair $(\mathbf{A},{\mathbf{B}}_{\mathbf{y}})$ and embeds ${\mathbf{B}}_{\mathbf{y}}$ as ${\mathbf{p}}_{\mathbf{y}}$. If ${\mathbf{B}}_{\mathbf{y}}$ is a valid Module-LWE sample, the view is that of Game₃; if ${\mathbf{B}}_{\mathbf{y}}$ is uniform, the view is that of Game₄. Hence, any distinguisher between the two games yields a distinguisher for the decisional Module-LWE problem.    □

• Game₅:

This game is identical to Game₄, except that $w_{\mathbf{y}}$ is replaced with a uniformly random value of the same length.

Lemma 9.

For any PPT adversary $\mathcal{A}$, $Pr\left[S_4\right]=Pr\left[S_5\right]$.

Proof. 

By Lemma 3, the output of the reconciliation bit ${\mathsf{Mod}}_2(·,·)$ is uniformly distributed once its input is uniform. In Game₄, the value from which $w_{\mathbf{y}}$ is derived is already replaced by a uniformly random element. Hence, replacing $w_{\mathbf{y}}$ by an explicit uniformly random value does not change the adversary’s view.    □

• Game₆:

This game is identical to Game₅, except that the challenge ciphertext is replaced by a uniformly random ciphertext of the same length.

The following lemma isolates the only nontrivial step needed to complete the IND-CPA argument.

Lemma 10

(Standard FO-style masking step). In Game₅, assume that the masking value

$$s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+\mathrm{H}\left(s{k}_{\mathbf{y}}\right)·{\mathbf{a}}_{\mathbf{y}}$$

is computationally indistinguishable from a uniformly random element of the message space, even given the public view $(\mathbf{A},{\mathbf{p}}_{\mathbf{x}},{\mathbf{p}}_{\mathbf{y}},w_{\mathbf{y}})$. Then, for any PPT adversary $\mathcal{A}$, $\left|Pr\left[S_5\right]-Pr\left[S_6\right]\right|\le \mathsf{negl}\left(\lambda \right)$. This step follows the standard FO-style masking argument; see [23,24,25].

Proof. 

In Game₅, the challenge ciphertext has the form

$$ct=(c{t}_1,c{t}_2),c{t}_2=s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+\left(m_b+\mathrm{H}\left(s{k}_{\mathbf{y}}\right)·{\mathbf{a}}_{\mathbf{y}}\right),$$

where b is the challenge bit. By the assumption of the lemma, the masking term

$$s{k}_{\mathbf{y}}·{\mathbf{p}}_{\mathbf{x}}^{\prime }+\mathrm{H}\left(s{k}_{\mathbf{y}}\right)·{\mathbf{a}}_{\mathbf{y}}$$

is computationally indistinguishable from a uniformly random element, even conditioned on the public view. Therefore, $c{t}_2$ is computationally indistinguishable from a uniformly random encoding of the same length and, in particular, is independent of the challenge bit b. Since $c{t}_1$ is already independent of b in Game₅, replacing the entire challenge ciphertext by a uniformly random ciphertext changes the adversary’s success probability by at most a negligible amount.    □

Theorem 1.

Assume that the PRF is secure, the decisional Module-LWE problem is hard, and the hypothesis of Lemma 10 holds. Then, MoRo.CPAPKE is IND-CPA-secure. More precisely, for any PPT adversary $\mathcal{A}$, there exist PPT adversaries ${\mathcal{B}}_0,{\mathcal{B}}_1,{\mathcal{B}}_2$ such that

$$\begin{array}{c}\hfill {\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CPAPKE}}^{\mathsf{ind}-\mathsf{cpa}}\left(\mathcal{A}\right)\le {\mathsf{Adv}}_{\mathrm{PRF}}\left({\mathcal{B}}_0\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_1\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_2\right)+\mathsf{negl}\left(\lambda \right).\end{array}$$

Proof. 

By construction, the challenge ciphertext in Game₆ is independent of the challenge bit. Hence, $Pr\left[S_6\right]={\displaystyle \frac{1}{2}}$. Using the triangle inequality together with Lemmas 5–10, we obtain

$$\begin{array}{cc}\hfill {\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CPAPKE}}^{\mathsf{ind}-\mathsf{cpa}}\left(\mathcal{A}\right)& =\left|Pr\left[S_0\right]-{\displaystyle \frac{1}{2}}\right|\hfill \\ & =\left|Pr\left[S_0\right]-Pr\left[S_6\right]\right|\hfill \\ & \le {\displaystyle \sum _{i=0}^5}\left|Pr\left[S_i\right]-Pr\left[S_{i+1}\right]\right|\hfill \\ & \le {\mathsf{Adv}}_{\mathrm{PRF}}\left({\mathcal{B}}_0\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_1\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_2\right)+\mathsf{negl}\left(\lambda \right).\hfill \end{array}$$

This proves the theorem.    □

5.2. IND-CCA Security (ROM)

We now derive the IND-CCA security of the KEM from the IND-CPA security of the underlying PKE via the Fujisaki–Okamoto (FO) transform. Rather than reproving the FO transform from scratch, we invoke the standard modular ROM analysis of Hofheinz, Hövelmanns, and Kiltz [23].

Theorem 2.

Assume that the hypotheses of Theorem 1 hold and let δ be the decryption-failure probability defined in (3). Then, in the random oracle model (ROM), MoRo.CCAKEM is IND-CCA-secure. More precisely, for any PPT adversary $\mathcal{A}$ making at most $q_{RO}$ random-oracle queries, there exists a PPT adversary $\mathcal{B}$ such that

$${\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CCAKEM}}^{\mathsf{ind}-\mathsf{cca}}\left(\mathcal{A}\right)\le {\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CPAPKE}}^{\mathsf{ind}-\mathsf{cpa}}\left(\mathcal{B}\right)+4q_{RO}\delta .$$

Consequently, by Theorem 1,

$$\begin{array}{c}\hfill {\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CCAKEM}}^{\mathsf{ind}-\mathsf{cca}}\left(\mathcal{A}\right)\le {\mathsf{Adv}}_{\mathrm{PRF}}\left({\mathcal{B}}_0\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_1\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_2\right)+4q_{RO}\delta +\mathsf{negl}\left(\lambda \right).\end{array}$$

Proof. 

The claim follows by applying the standard ROM security theorem for the Fujisaki–Okamoto transform [23] to the PKE scheme MoRo.CPAPKE. The required PKE security is provided by Theorem 1, and the only additional loss comes from decryption failures, whose probability is $\delta$. Substituting the bound from Theorem 1 yields the final inequality.    □

5.3. IND-CCA Security (QROM)

We next extend the above argument to the quantum random oracle model (QROM). Again, the cleanest formulation is to invoke the standard QROM analysis for the FO transform rather than to sketch the proof directly.

Theorem 3.

Assume that the hypotheses of Theorem 1 hold and let δ be the decryption-failure probability defined in (3). Then, in the quantum random oracle model (QROM), MoRo.CCAKEM is IND-CCA-secure. More precisely, for any quantum adversary $\mathcal{A}$ making at most $q_{RO}$ quantum random-oracle queries, there exists an adversary $\mathcal{B}$ such that

$${\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CCAKEM}}^{\mathsf{ind}-\mathsf{cca}}\left(\mathcal{A}\right)\le 4q_{RO}\sqrt{{\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CPAPKE}}^{\mathsf{ind}-\mathsf{cpa}}\left(\mathcal{B}\right)}+8q_{RO}^2\delta .$$

Consequently, by Theorem 1,

$${\mathsf{Adv}}_{\mathsf{MoRo}.\mathsf{CCAKEM}}^{\mathsf{ind}-\mathsf{cca}}\left(\mathcal{A}\right)\le 4q_{RO}\sqrt{X}+8q_{RO}^2\delta ,$$

where

$$X={\mathsf{Adv}}_{\mathrm{PRF}}\left({\mathcal{B}}_0\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_1\right)+{\mathsf{Adv}}_{\mathrm{MLWE}}\left({\mathcal{B}}_2\right)+\mathsf{negl}\left(\lambda \right).$$

Proof. 

The result follows from the standard QROM security analysis of FO-based KEMs [23,26], applied to the PKE scheme MoRo.CPAPKE. The underlying IND-CPA bound is supplied by Theorem 1, and the additional term is due to the decryption-failure probability $\delta$. Substituting the IND-CPA bound gives the stated inequality.    □

6. Parameter Sets

We select the parameters by taking into account the decryption failure rate, computational security, and compatibility with the number-theoretic transform (NTT). The resulting parameter sets are summarized in

Table 1. Security parameter candidates for MoRo KEM.

n	k	q	p	t	$\mathit{\eta }$	${\mathit{\delta }}_{\mathbf{fail}}$	Estimate for Classical Attacks Using [27]
128	3	7681	1920	2	3	$2^{-181}$	107
256	3	3329	960	2	2	$2^{-44}$	146
256	3	7681	1920	2	2	$2^{-166}$	199

, and a comparison with DKE and Kyber is given in

Table 2. Comparison of schemes at AES-128 security level.

Scheme	Structure	n	q	p	Security	${\mathit{\delta }}_{\mathbf{fail}}$	${\mathbf{Size}}_{\mathbf{pk}}$ (Bytes)	${\mathbf{Size}}_{\mathbf{ct}}$ (Bytes)
Kyber [8]	Module-LWE	256	3329	1024	IND-CCA	$2^{-139}$	800	768
DKE-512 [7]	Ring-LWE	512	120833	7552	Passive	$2^{-60}$	832	1744
MoRo	Module-LWE	256	7681	1920	IND-CCA	${\mathbf{2}}^{-\mathbf{166}}$	1088	2336

. We propose the parameter set with $q=7681$ because it provides a larger noise margin and achieves a lower decryption failure rate while maintaining the targeted security level. The decryption failure rate was evaluated using a Python 3.12.3 simulation script based on the error distribution in Equation (3). Compared with the original Ring-LWE-based DKE construction, the transition to the Module-LWE setting increases the public-key and ciphertext sizes due to the module dimension k and the associated vector structure. Nevertheless, this trade-off enhances overall robustness by combining the conservative security assumptions underlying LWE with the efficiency gains enabled by NTT-based computation in Ring-LWE. To estimate computational security against the Module-LWE problem, we use the LWE Estimator with the 2016 cost model [27]. More precisely, letting $\beta$ denote the BKZ block size, the sieving-based attack cost is estimated by

$$T_{\mathrm{sieving}-\mathrm{BKZ}}=8d·2^{0.292\beta +16.4}·64\left(\mathrm{bits}\right).$$

We report the best-known attack cost in ${log}_2$ operations and select parameter sets that satisfy NIST Level $\mathrm{I}$ security, namely, AES-128-bit security. In particular, our main parameter set achieves a decryption failure rate of $2^{-166}$, which is lower than $2^{-143}$ and therefore provides stronger robustness against decryption-failure attacks.

Performance of MoRo on Intel Xeon

We evaluated the performance of our MoRo implementation on an Intel Xeon Gold 6240 CPU at 2.60 GHz and report both cycle counts and running time. Our implementation was written in C and compiled with gcc 8.5.0 using the default Makefile settings. For fair comparison, Kyber was also evaluated under the same hardware and software environment. The benchmark output is reported in cycles, which we interpret as CPU-cycle-level cost. For KEM-level evaluation, corresponding to key generation, encapsulation, and decapsulation, we report the median over 10,000 executions, as shown in

Table 3. Cycle counts of MoRo for KEM.

Operation	Cycles	Runtime (μs)
Kyber_keypair	88,932	34.094
Kyber_encaps	107,376	41.008
Kyber_decaps	138,336	52.929
MoRo_keypair	162,020	61.989
MoRo_encaps	403,904	154.972
MoRo_decaps	646,702	248.909

. The parameter set used in our experiments is listed in Table 2.

7. Conclusions

In this paper, we first constructed a public-key encryption (PKE) scheme based on the DKE mechanism and proved its IND-CPA security. We then obtained a key-encapsulation mechanism (KEM) by applying a slight variant of the Fujisaki–Okamoto (FO) transform to this PKE and proved its IND-CCA security. Moreover, we proposed parameter sets that achieve a decryption failure rate as low as $2^{-166}$ while satisfying AES-128-bit security. In addition, we implemented the proposed scheme and evaluated its performance, demonstrating its practical efficiency.

Beyond the core cryptographic contribution, our results also suggest the relevance of MoRo-KEM to post-quantum protection in IoT and sensor-network environments. In such scenarios, secure key establishment must be achieved under practical constraints on computation, memory, and communication, while maintaining robustness across a large number of distributed devices. The combination of Module-LWE-based efficiency, implementation-friendly sampling, and a low decryption failure rate makes the proposed scheme a meaningful candidate for secure communications between sensor nodes, edge devices, and gateways in long-lived systems that must prepare for the advent of quantum attacks. Accordingly, we believe that the proposed construction provides not only a useful theoretical extension of DKE, but also a practical post-quantum design direction for secure IoT and sensing applications.