Paper 2018/024

KEM Combiners

Federico Giacon, Felix Heuer, and Bertram Poettering


Key-encapsulation mechanisms (KEMs) are a common stepping stone for constructing public-key encryption. Secure KEMs can be built from diverse assumptions, including ones related to integer factorization, discrete logarithms, error correcting codes, or lattices. In light of the recent NIST call for post-quantum secure PKE, the zoo of KEMs that are believed to be secure continues to grow. Yet, on the question of which is the most secure KEM opinions are divided. While using the best candidate might actually not seem necessary to survive everyday life situations, placing a wrong bet can actually be devastating, should the employed KEM eventually turn out to be vulnerable. We introduce KEM combiners as a way to garner trust from different KEM constructions, rather than relying on a single one: We present efficient black-box constructions that, given any set of `ingredient' KEMs, yield a new KEM that is (CCA) secure as long as at least one of the ingredient KEMs is. As building blocks our constructions use cryptographic hash functions and blockciphers. Some corresponding security proofs require idealized models for these primitives, others get along on standard assumptions.

Available format(s)
Public-key cryptography
Publication info
A minor revision of an IACR publication in PKC 2018
secure combinersCCA securitypractical constructions
Contact author(s)
bertram poettering @ rhul ac uk
2018-01-07: received
Short URL
Creative Commons Attribution


      author = {Federico Giacon and Felix Heuer and Bertram Poettering},
      title = {{KEM} Combiners},
      howpublished = {Cryptology ePrint Archive, Paper 2018/024},
      year = {2018},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.