{"slug": "faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac", "title": "Faster generic CCA secure KEM transformation using encrypt-then-Mac", "summary": "A Cryptology ePrint Archive paper (2026/2442) by Ganyu Xu, Kalikinkar Mandal and Guang Gong presents ML-KEM-EtM, an IND-qCCA secure KEM built by applying an encrypt-then-MAC transformation to ML-KEM's PKE subroutines, which the authors say substantially reduces decapsulation CPU cycles at the cost of only a minimal increase in encapsulation CPU cycles and ciphertext size. The transformation authenticates the PKE ciphertext with a MAC keyed from the plaintext, applies the random oracle only to the short plaintext rather than the full ciphertext, and is proven IND-CCA secure in the random oracle model when the underlying PKE is one-way under plaintext-checking attack (OW-PCA), with a fine-grained OW-qPCA notion yielding IND-qCCA security. The authors implement ML-KEM-EtM with Poly1305, GMAC, CMAC and KMAC256, and also instantiate McElieceEtM with Classic McEliece for full IND-CCA security under the conjectured OW-PCA security of its Niederreiter PKE.", "body_md": "#### Paper 2026/2442\n\n### [Faster generic CCA secure KEM transformation using encrypt-then-MAC](https://eprint.iacr.org/2026/2442.pdf)\n\n##### Abstract\n\nML-KEM is a lattice-based IND-CCA secure key encapsulation mechanism (KEM) standardized by NIST in FIPS 203. ML-KEM achieves chosen-ciphertext security by applying the Fujisaki-Okamoto (FO) transformation to an IND-CPA secure public key encryption (PKE) scheme. The FO transformation uses de-randomization and re-encryption to ensure ciphertext non-malleability, but because ML-KEM's underlying PKE encryption subroutine is slower than the decryption subroutine, ML-KEM's decapsulation performance is dominated by re-encryption. In this paper, we revisit the ``encrypt-then-MAC'' paradigm as a generic KEM transformation: the PKE ciphertext is authenticated by a message authentication code (MAC) whose key is derived from the PKE plaintext. We prove that the transformation achieves IND-CCA security in the random oracle model when the underlying PKE is one-way under plaintext-checking attack (OW-PCA), and we introduce a fine-grained security notion, one-wayness under $q$-bounded plaintext-checking attack (OW-$q$PCA), under which the transformation achieves IND-$q$CCA security. In contrast to the tag-based IND-1CCA transformations of Huguenin-Dumittan and Vaudenay (Eurocrypt 2022), whose tag is a random-oracle hash of the plaintext and the entire ciphertext, our transformation applies the random oracle only to the short PKE plaintext, while the long ciphertext is processed by a standard-model MAC that needs only to be one-time existentially unforgeable. We present ML-KEM-EtM, an IND-$q$CCA secure KEM derived from applying the encrypt-then-MAC transformation to the PKE subroutines of ML-KEM, and McElieceEtM, an instantiation with Classic McEliece that achieves full IND-CCA security under the conjectured OW-PCA security of its Niederreiter PKE. We implement ML-KEM-EtM with a wide selection of MACs including Poly1305, GMAC, CMAC, and KMAC256. At the cost of minimal increase in encapsulation CPU cycle count and ciphertext size, ML-KEM-EtM achieves a substantial reduction of the decapsulation CPU cycle count.\n\n##### Metadata\n\n- Available format(s)\n- \n[PDF](https://eprint.iacr.org/2026/2442.pdf)\n- Category\n- [Public-key cryptography](https://eprint.iacr.org/search?category=PUBLICKEY)\n- Publication info\n- Preprint.\n- Keywords\n- [Post-quantum](https://eprint.iacr.org/search?q=Post-quantum)[KEM](https://eprint.iacr.org/search?q=KEM)[ML-KEM](https://eprint.iacr.org/search?q=ML-KEM)[Encrypt-then-MAC](https://eprint.iacr.org/search?q=Encrypt-then-MAC)\n- Contact author(s)\n- \n        g66xu @ uwaterloo ca\n kmandal @ unb ca\nggong @ uwaterloo ca\n- History\n- 2026-10-14: approved\n- 2026-10-11: received\n- [See all versions](https://eprint.iacr.org/archive/versions/2026/2442)\n- Short URL\n- [https://ia.cr/2026/2442](https://ia.cr/2026/2442)\n- License\n- \n[CC BY](https://creativecommons.org/licenses/by/4.0/)\n\n**BibTeX** \n\n```\n@misc{cryptoeprint:2026/2442,\n      author = {Ganyu Xu and Kalikinkar Mandal and Guang Gong},\n      title = {Faster generic {CCA} secure {KEM} transformation using encrypt-then-{MAC}},\n      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2442},\n      year = {2026},\n      url = {https://eprint.iacr.org/2026/2442}\n}\n```\n\n", "url": "https://wpnews.pro/news/faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac", "canonical_source": "https://eprint.iacr.org/2026/2442", "published_at": "2026-10-19 23:43:44+00:00", "updated_at": "2026-10-20 00:16:52.957292+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-safety"], "entities": ["ML-KEM", "NIST", "FIPS 203", "Ganyu Xu", "Kalikinkar Mandal", "Guang Gong", "Classic McEliece", "Cryptology ePrint Archive"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac", "markdown": "https://wpnews.pro/news/faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac.md", "text": "https://wpnews.pro/news/faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac.txt", "jsonld": "https://wpnews.pro/news/faster-generic-cca-secure-kem-transformation-using-encrypt-then-mac.jsonld"}}