D-HPPK KEM: A Defactorized Homomorphic Polynomial Public Key Encapsulation Mechanism for IND-CCA2 Security

1. Introduction

The Homomorphic Polynomial Public Key (HPPK) cryptosystem, introduced by Kuang and Perepechaenko in 2023 [1], evolved from the earlier Multivariate Polynomial Public Key (MPPK) framework [2]. Its construction relies on two private univariate polynomials $f\left(x\right),h\left(x\right)\in {\mathbb{F}}_p\left[x\right]$, which generate product polynomials

$$p(x,\mathbf{u})=f\left(x\right)B(x,\mathbf{u}),q(x,\mathbf{u})=h\left(x\right)B(x,\mathbf{u}),$$

where $B(x,\mathbf{u})$ is an ephemeral multivariate polynomial. The system preserves the homomorphic ratio

$${\displaystyle \frac{f\left(x\right)}{h\left(x\right)}}\equiv {\displaystyle \frac{p(x,\mathbf{u})}{q(x,\mathbf{u})}}(modp),$$

(1)

with security originally derived from arithmetic permutations of coefficient vectors induced by two large hidden rings.

1.1. Motivation and the D-HPPK Approach

The history of multivariate cryptography is marked by a recurring pattern: elegant constructions are proposed, later found to harbor algebraic regularities, and then patched or replaced [3,4,5,6]. Rainbow, for instance, advanced to the NIST PQC finalists before a devastating attack exploited its hidden field structure [7,8].

The original HPPK construction offered compact keys and efficient operations, leveraging hidden-ring permutations to conceal its polynomial factorization. However, Johnson [9] has shown that the hidden-ring embedding itself is vulnerable to a polynomial-time key-recovery attack, the Lattice Reconstitution Attack (LRA). The public key has the form ${\widehat{P}}_{ij}\equiv P_{ij}·r(modt)$, where a single scalar multiplier r is applied to all coefficients and t is a hidden modulus larger than the coefficients. An attacker can build a discriminator matrix from Bézout coefficients of pairs of public coefficients; row reduction and LLL lattice reduction then recover the hidden modulus t and hence the full secret key in $O\left({(logp)}^3\right)$ classical time and $O(logp)$ memory, with deterministic success. The attack exploits the combined structure of the single scalar multiplier and the low-rank factorization of the unmasked coefficient matrices, rather than the rank of the coefficients alone. The LRA invalidates the security assumptions of the original HPPK KEM.

To defend against the LRA and the algebraic-regularity attack more generally, we introduce the Defactorized HPPK (D-HPPK) KEM, which combines additive random masking with hidden-ring embeddings in a three-layer conjugated architecture. The random masking is applied before embedding into the hidden rings. The published coefficients become ${\widehat{P}}_{ij}\equiv (P_{ij}^{\left(0\right)}+c_i^{\left(p\right)}{d}_j(modp))R_1(mod{S}_1)$, where the rank-one perturbation $c_i^{\left(p\right)}{d}_j$ destroys the rank-two structure of $P^{\left(0\right)}$ and removes the low-dimensional structure on which the LRA depends. A linear constraint $\delta \left(\mathbf{u}\right)={\mathbf{d}}^{\top }\mathbf{u}=0$ ensures that the masking cancels exactly during decryption, restoring the homomorphic ratio invariant. Critically, this cancellation is enforced inside the hidden rings, so the adversary cannot evaluate the condition without knowledge of the secret moduli. The result is a pair of complementary mechanisms: the hidden rings block the public-constraint attack, and the random masking blocks the algebraic-regularity attack. An adversary is forced into the generic HMPP problem analyzed in Section 4.5, and the decryption-safety properties required for the CCA reduction are established in Section 4.4.

We emphasize that the masking provides a single barrier against the algebraic-regularity attack, not a second exponential barrier after HMPP. Once the hidden rings are broken, the factorization recovery is polynomial in L. This drives the equal-cost structure discussed next.

1.2. Security Model and Search-Based Framework

D-HPPK grounds security in five hardness assumptions, stated formally in Section 4.3.

Long-term key recovery. Reduces to the Hidden Modulus Product Problem (HMPP): recover the hidden modulus S and multiplier R from the public samples $A_i\equiv R{\tilde{a}}_i(modS)$. Once HMPP is broken, the factorization structure of the masked coefficient matrices is recoverable in polynomial time via projection onto the public subspace ${\mathbf{d}}^{\perp }$. Best-known classical cost: $O(2^l·poly\left(L\right))$.

Ephemeral secret recovery. Is the Message Recovery Problem (MRP), in two forms. The single-ciphertext form ${\mathrm{MRP}}_1$ defines the hardness of the base PKE: given $\mathbf{PK}$ and $C=\mathrm{Enc}(\mathbf{PK},x;\mathbf{u})$, recover x. The double-ciphertext form ${\mathrm{MRP}}_2$ matches the KEM challenge: given $\mathbf{PK}$ and $(C^{\left(1\right)},C^{\left(2\right)})$ both encrypting the same x under independent randomness, recover x. Best-known attack on both: $O(2^l·L^2)$.

Decryption safety. Is the scheme-induced pairwise decryption-collision resistance assumption: for every fixed ciphertext pair $C^{\left(1\right)}\ne C^{\left(2\right)}$ outside the rejection set, the two decryptions collide with probability at most $1/p+\mathrm{negl}\left(\lambda \right)$ over the secret key. This is a companion to ${\mathrm{MRP}}_2$: where ${\mathrm{MRP}}_2$ excludes recovery of $x^{*}$ from the challenge pair, the collision assumption excludes oracle leakage through malformed queries. Marginal uniformity of each decryption output is proved from the hidden-ring modular reduction (Lemmas 1 and 2); the joint near-independence of two outputs is assumed and is the genuinely two-dimensional statement not proved here (Assumption 5). The adaptive version is derived through Structured D-HMPP (Lemma 3).

Search-based security convention. We adopt the same framework NIST uses for AES: a primitive is assigned security level l when the best-known attack requires exhaustive search over a space of size $2^l$ with efficient verification, and no structural attack reduces the search space. This is a definitional level assignment, not a theorem. The same convention applies to D-HPPK: both attack paths are exhaustive searches over $2^l$ candidates with polynomial-time verification, giving security level l and NIST categories $l=128,192,256$ for Levels I, III, and V. D-HPPK is therefore a search-based cryptosystem in the sense of Merkle’s puzzles [10] and AES. The cryptanalysis in Section 4 supports the level assignment by surveying known attack families on HMPP and MRP and finding none that reduces the search space.

1.3. Contributions

• Two-barrier security architecture. We separate the public-constraint attack (blocked by hidden rings) from the algebraic-regularity attack (blocked by masking), and show that neither mechanism subsumes the other.
• Key-recovery analysis. Stage 2 of the key-recovery attack is polynomial-time after HMPP, giving a best-known classical cost of $O(2^l·poly\left(L\right))$, matching the ephemeral-secret recovery cost.
• Five hardness assumptions with a reduced decryption-safety property. Marginal statistical uniformity of the decryption output is proved from the hidden-ring modular reduction; pairwise collision resistance is stated as a scheme-induced assumption with a companion role to ${\mathrm{MRP}}_2$, and its adaptive form is derived through Structured D-HMPP. The IND-CCA2 proof rests on the conjunction of four of the five assumptions.
• IND-CCA2 security via double encryption with a strengthened consistency check. A union bound over both attack paths, with a five-class rejection set for correlated adversarial ciphertexts, a simulation argument justifying the game-level restriction, and the random-oracle advantage bound quantified.
• Compact parameterization and algorithmic simplicity. Unified parameter set $(n=2,m=3,l=\lceil {log}_{2}p\rceil )$ across security levels. At $l=256$, D-HPPK achieves a 1234-byte public key and a 392-byte CCA2 ciphertext — 21% and 75% smaller than ML-KEM-1024 — without SIMD or NTT acceleration.

Scope and limitations. The security analysis is in the classical random oracle model; a quantum random-oracle proof is left for future work. The five assumptions are new problems or scheme-induced assumptions; the analysis reports best-known attacks and invites further cryptanalysis. The current reference implementation is not constant-time. These limitations are addressed explicitly in Section 4 and Section 5.

2. Related Work

Public-key cryptography has historically relied on the hardness of integer factorization, discrete logarithms, and elliptic-curve discrete logarithms. Shor’s quantum algorithm [11] breaks these assumptions, prompting the development of post-quantum cryptography (PQC). NIST initiated a multi-round standardization process [12] to select quantum-resistant algorithms for key encapsulation and digital signatures.

2.1. NIST Standardization and PQC Families

The first set of NIST standards, finalized in 2024, includes lattice-based ML-KEM [13] for key encapsulation, ML-DSA and FN-DSA [14,15] for signatures, and hash-based SLH-DSA [16,17]. Classic McEliece [18,19] continues as a fourth-round code-based candidate with large public keys, and NTRU Prime [20] provides an alternative lattice-based KEM. Earlier multivariate (Rainbow [7]) and isogeny-based (SIKE [21]) submissions were later broken [8,22], underscoring the community’s effort to diversify hardness assumptions.

Lattice-based schemes operate in polynomial rings ${\mathbb{Z}}_q\left[x\right]/(x^n+1)$ using the Module-LWE problem and benefit from strong reductions to worst-case lattice problems, but face large key and ciphertext sizes (ML-KEM-1024: 1568-byte public key and ciphertext), reliance on NTT accelerators, and side-channel susceptibility. Code-based cryptography, exemplified by Classic McEliece, offers conservative security but requires public keys in the hundreds of kilobytes. The two families rest on different hardness assumptions and provide complementary foundations.

2.2. Multivariate Polynomial Cryptography

Multivariate polynomial cryptography provides an algebraic framework with security assumptions rooted in the hardness of solving nonlinear multivariate equations over finite fields. Traditional multivariate schemes [6] have historically found more success in signature constructions — exemplified by Rainbow [7], though recently broken [8] — than in practical key encapsulation mechanisms, due to large key sizes, computational cost, and the scarcity of IND-CCA2-secure designs that avoid complex transforms [6].

The security of multivariate schemes has been repeatedly challenged by algebraic cryptanalysis, and this history informs the design choices in D-HPPK. The additive random masking is specifically designed to destroy the algebraic regularities that have proven exploitable in other multivariate schemes, and the security proof in Section 4 explicitly analyzes the Gröbner basis attack surface of the resulting system.

The MMPS problem introduced in Section 4.6.1 belongs to the well-studied class of structured polynomial systems over finite fields. Systems that are linear in one set of variables and polynomial in another have been analyzed in the algebraic cryptanalysis literature. Faugère, Levy-dit-Vehel, and Perret studied the MinRank problem and its bilinear structure, showing that eliminating the linear variables yields a low-degree univariate relation [23]. Faugère’s broader survey of structured polynomial systems situates these techniques within computational algebra [24], and Petit and Quisquater analyzed polynomial systems arising from Weil descent, which share the mixed linear-polynomial structure [25]. For the hidden-modulus aspect, the black-box field problem of Boneh and Lipton [26] and Coppersmith’s algorithms for small solutions of modular polynomial equations [27] provide the closest precedents. The MMPS problem differs from all of these in that its coefficients are generated by the D-HPPK key generation and encryption process, rather than being drawn from an arbitrary or uniform distribution.

Finally, we note that alternative algebraic foundations for post-quantum cryptography have been explored outside the polynomial and lattice families. Selim, Saračević, and Ćatović recently proposed a homomorphic cryptographic scheme based on nilpotent Lie algebras [28], using a different hardness foundation from the polynomial homomorphism and hidden-ring approach of D-HPPK.

2.3. KEM Transformations and Hidden-Modulus Problems

The standard method for converting a passively secure public-key encryption scheme into an IND-CCA2 secure KEM is the Fujisaki-Okamoto (FO) transform [29] and its modular reanalyses [30], widely used in ML-KEM [13] and extended to the quantum random oracle model [30,31]. Closely related are plaintext-aware and robust encryption notions [32,33], and generic KEM constructions [34]. The double-encryption construction used in D-HPPK belongs to this family. Its security relies on ${\mathrm{MRP}}_2$ plus a pairwise decryption-collision assumption, rather than on the FO re-encryption check.

The HMPP introduced in this work is related in spirit to the Approximate Common Divisor (ACD) problem [35,36,37,38], but differs in structure. In ACD, the adversary receives samples $x_i=p{q}_i+r_i$ with a hidden large divisor p and small errors $r_i$, and recovers p by exploiting the small residues $x_{i}modp$. In HMPP, the hidden quantities are the modulus S itself and a multiplier $R\in {\mathbb{Z}}_S^{*}$, and the public samples are $A_i\equiv R{\tilde{a}}_i(modS)$ with small values ${\tilde{a}}_i\in [0,p-1]$. The samples $A_i$ are uniform residues modulo S: no small-residue structure is visible until S is known. The standard ACD lattice template, which relies on small residues modulo the unknown divisor, does not transfer directly to HMPP; whether an adapted construction can recover S from a single guess of ${\tilde{a}}_1$ is examined in Section 4.5.

2.4. Search-Based Cryptography

Search-based cryptography reduces security to the size of a search space and the efficiency of verification, following the convention NIST uses for AES. For unstructured search problems, Grover’s algorithm [39] provides a quadratic speedup, unlike Shor’s algorithm [11] for factoring and discrete logarithms. This makes search-based assumptions a conservative foundation for post-quantum security. Traditional constructions such as Merkle’s puzzles [10] have suffered from impractical key sizes; efficient CCA-secure extensions remain rare. D-HPPK embeds a structured algebraic layer — the homomorphic ratio invariant and masked polynomial representation — that aims to preserve search-based hardness while enabling compact keys, and uses a double-encryption consistency check to achieve IND-CCA2 security.

3. The Defactorized HPPK KEM Scheme

This section presents the complete construction of the Defactorized Homomorphic Polynomial Public Key (D-HPPK) Key Encapsulation Mechanism. The scheme employs a layered security architecture that combines additive random masking (over ${\mathbb{F}}_p$) with hidden ring embeddings.

We present the core mathematical objects and key generation (Section 3.1Section 3.2), then define a base Public Key Encryption (PKE) scheme (Section 3.3), and finally obtain an IND-CCA2-secure KEM via a double-encryption construction with a consistency check (Section 3.4).

3.1. Core Mathematical Objects and Notation

All operations are defined over a large prime field ${\mathbb{F}}_p$ with prime modulus p of bit-length l, i.e. $2^{l-1}\le p<2^l$, or equivalently $l=\lceil {log}_{2}p\rceil$. Where only leading-order behavior matters, we write l and ${log}_{2}p$ interchangeably, since the two differ by at most 1.

Two secret hidden-ring moduli $S_1,S_2$ of bit-length $L=2l+8$ and two secret multipliers $R_1,R_2$ are used. The moduli satisfy $S_1,S_2>9p^2$, and the multipliers are sampled uniformly from ${\mathbb{Z}}_{S_1}^{*}$ and ${\mathbb{Z}}_{S_2}^{*}$. The bound $S_i>9p^2$ is required for correct decryption (Section 3.3), and the choice $L=2l+8$ satisfies it for all relevant l, since $2^{2l+8}=256·2^{2l}>9p^2$ whenever $l\ge 1$. The moduli may be prime or composite; prime moduli simplify implementation, while composite moduli give faster key generation. The inverses $R_1^{-1}mod{S}_1$ and $R_2^{-1}mod{S}_2$ are computed at key generation.

The following objects form the mathematical foundation:

• Secret polynomials: $f\left(x\right)=f_{1}x+f_0\in {\mathbb{F}}_p\left[x\right]$ and $h\left(x\right)=h_{1}x+h_0\in {\mathbb{F}}_p\left[x\right]$.
• Ephemeral random polynomial: A random multivariate polynomial

  $$B(x,\mathbf{u})={\displaystyle \sum _{j=1}^m}\left({\displaystyle \sum _{i=0}^{n_b}}{b}_{ij}{x}^i\right)u_j$$

  with coefficients $\left\{b_{ij}\right\}\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$. It is multilinear in $\mathbf{u}$. For the default $n_b=1$, it is bilinear in $(x,\mathbf{u})$.
• Total degree: $p(x,\mathbf{u})=f\left(x\right)B(x,\mathbf{u})$ and $q(x,\mathbf{u})=h\left(x\right)B(x,\mathbf{u})$ have degree $n=1+n_b$. We set $n_b=1$, giving $n=2$.
• Core secret: The rational function $\mathsf{\Phi }\left(x\right)=f\left(x\right)/h\left(x\right)(modp)$, invariant under all transformations.

Notation conventions throughout: elements in ${\mathbb{F}}_p$ are lowercase letters; matrices in ${\mathbb{F}}_p$ are bold lowercase; integer lifts to $[0,p-1]$ carry a tilde; elements in the hidden rings ${\mathbb{Z}}_{S_i}$ carry a hat; $(·modp)$ returns an integer in $[0,p-1]$ and $(·mod{S}_i)$ returns an integer in $[0,S_i-1]$.

3.2. Key Generation

The key generation algorithm $\mathsf{KeyGen}\left(\right)$ produces a public key $\mathbf{PK}$ and a private key $\mathbf{SK}$ through three sequential transformations, as illustrated in Figure 1.

Transformation 1: Division Invariant (Embedding). Compute the product polynomials $p^{\left(0\right)}(x,\mathbf{u})=f\left(x\right)B(x,\mathbf{u})$ and $q^{\left(0\right)}(x,\mathbf{u})=h\left(x\right)B(x,\mathbf{u})$. Their coefficients form matrices ${\mathbf{P}}^{\left(0\right)},{\mathbf{Q}}^{\left(0\right)}\in {\mathbb{F}}_p^{(n+1)\times m}$. By construction,

$$\mathsf{\Phi }\left(x\right)\equiv {\displaystyle \frac{p^{\left(0\right)}(x,\mathbf{u})}{q^{\left(0\right)}(x,\mathbf{u})}}(modp)\mathrm{for}\mathrm{any}\mathbf{u}.$$

(2)

Transformation 2: Addition Invariant (Random Masking). Generate random ephemeral masking vectors ${\mathbf{c}}^{\left(p\right)},{\mathbf{c}}^{\left(q\right)}\in {\mathbb{F}}_p^{n+1}$ and a public persistent constraint vector $\mathbf{d}\in {\mathbb{F}}_p^m$ with $d_m=1$. Define rank-1 masking matrices ${\mathbf{M}}^{\left(p\right)}={\mathbf{c}}^{\left(p\right)}\otimes \mathbf{d}$ and ${\mathbf{M}}^{\left(q\right)}={\mathbf{c}}^{\left(q\right)}\otimes \mathbf{d}$, and compute

$${\mathbf{p}}^{\prime }={\mathbf{p}}^{\left(0\right)}+{\mathbf{M}}^{\left(p\right)}(modp),{\mathbf{q}}^{\prime }={\mathbf{q}}^{\left(0\right)}+{\mathbf{M}}^{\left(q\right)}(modp).$$

(3)

Denote the elements of ${\mathbf{p}}^{\prime }$ and ${\mathbf{q}}^{\prime }$ as $p_{ij}^{\prime }$ and $q_{ij}^{\prime }\in {\mathbb{F}}_p$. Define the constraint $\delta \left(\mathbf{u}\right)={\mathbf{d}}^{\top }\mathbf{u}$. The masking terms cancel when $\delta \left(\mathbf{u}\right)\equiv 0(modp)$ because

$${\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{c}_i^{\left(p\right)}{d}_j{x}^i{u}_j=\left({\displaystyle \sum _{i=0}^n}{c}_i^{\left(p\right)}{x}^i\right)\delta \left(\mathbf{u}\right).$$

(4)

Thus the invariant holds:

$$\mathsf{\Phi }\left(x\right)\equiv {\displaystyle \frac{p^{\prime }(x,\mathbf{u})}{q^{\prime }(x,\mathbf{u})}}(modp)\mathrm{when}\delta \left(\mathbf{u}\right)=0(modp),$$

(5)

where $p^{\prime }(x,\mathbf{u})={\sum }_{i,j}{p}_{ij}^{\prime }{x}^i{u}_j$ and $q^{\prime }(x,\mathbf{u})={\sum }_{i,j}{q}_{ij}^{\prime }{x}^i{u}_j$.

Transformation 3: Multiplication Invariant (Embedding into Hidden Rings). Embed the masked coefficients $p_{ij}^{\prime },q_{ij}^{\prime }\in {\mathbb{F}}_p$ into the hidden rings by multiplying by the secret multipliers $R_1,R_2$ and reducing modulo the secret moduli $S_1,S_2$:

$${\widehat{P}}_{ij}\equiv p_{ij}^{\prime }·R_1(mod{S}_1),{\widehat{Q}}_{ij}\equiv q_{ij}^{\prime }·R_2(mod{S}_2).$$

(6)

Key Pair. The following intermediate values are permanently discarded: the ephemeral masking vectors ${\mathbf{c}}^{\left(p\right)},{\mathbf{c}}^{\left(q\right)}$; all basis polynomial coefficients $\left\{b_{ij}\right\}$; and the intermediate matrices ${\mathbf{P}}^{\left(0\right)},{\mathbf{Q}}^{\left(0\right)},{\mathbf{p}}^{\prime },{\mathbf{q}}^{\prime }$. Only the final values are retained:

$$\begin{array}{|c|}\hline \begin{array}{cc}\hfill \mathbf{PK}& =\left({\{{\widehat{P}}_{ij},{\widehat{Q}}_{ij}\}}_{i=0,1,2;j=1,\dots ,m},{\left\{d_j\right\}}_{j=1,\dots ,m-1}\right),\hfill \\ \hfill \mathbf{SK}& =\left(f_0,f_1,h_0,h_1,S_1,S_2,R_1^{-1}mod{S}_1,R_2^{-1}mod{S}_2\right).\hfill \end{array}\\ \hline\end{array}$$

(7)

The public key contains the masked coefficients as integers modulo the hidden moduli. The secret key holds the original polynomials, the hidden moduli, and the inverses of the multipliers.

3.3. Base Public Key Encryption Scheme

The base PKE scheme encrypts a message $x\in {\mathbb{F}}_p$ using a random noise vector $\mathbf{u}$ chosen from the kernel of the public constraint $\delta \left(\mathbf{u}\right)=0$. The ciphertext consists of two integers $c_p$ and $c_q$, computed as ordinary integer weighted sums of the public hidden-ring coefficients ${\widehat{P}}_{ij}$ and ${\widehat{Q}}_{ij}$, evaluated at the field values $x^i{u}_j$. The encrypter does not know the secret moduli $S_1,S_2$; thus the ciphertext is not reduced modulo these values and is typically much larger than $S_1$ or $S_2$. An adversary cannot simply reduce the ciphertext modulo p to recover the underlying field equation because the large $S_1$-scaled terms do not vanish without knowledge of the secret moduli, thereby blocking the fatal public-constraint attack.

Decryption recovers the masked field values by first reducing the ciphertext modulo $S_1$ and $S_2$, then unwrapping the hidden rings using the secret multipliers and moduli. The ratio of the recovered field values yields the invariant $\mathsf{\Phi }\left(x\right)=f\left(x\right)/h\left(x\right)(modp)$, from which x is uniquely recovered.

Encryption $\mathsf{Enc}(\mathbf{PK},x;\mathbf{u})$. Given a message $x\in {\mathbb{F}}_p$ and randomness $\mathbf{u}=(u_1,\dots ,u_m)\in {\mathbb{F}}_p^m$ satisfying $\delta \left(\mathbf{u}\right)=0$, compute the integer values

$$\begin{array}{cc}\hfill c_p& ={\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\widehat{P}}_{ij}\left(x^i\times u_j(modp)\right),\hfill \\ \hfill c_q& ={\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\widehat{Q}}_{ij}\left(x^i\times u_j(modp)\right),\hfill \end{array}$$

(8)

where each product $(x^{i}modp)(u_{j}modp)$ is reduced modulo p to an integer in $[0,p-1]$, and the outer multiplication by ${\widehat{P}}_{ij}$ is performed over the integers. Since ${\widehat{P}}_{ij}\in [0,S_1-1]$ and each reduced product lies in $[0,p-1]$, every term of the sum lies in $[0,(S_1-1)(p-1)]$, and the ciphertext component satisfies

$$c_p\le (n+1)m(S_1-1)(p-1)<(n+1)mp{S}_1,$$

and similarly $c_q<(n+1)mp{S}_2$. For the default parameters $n=2$, $m=3$, this gives $c_p<9p{S}_1$ and $c_q<9p{S}_2$. Output $C=(c_p,c_q)$.

Decryption $\mathsf{Dec}(\mathbf{SK},C)$. Given a ciphertext $C=(c_p,c_q)$:

1.

Compute $a=R_1^{-1}·(c_{p}mod{S}_1)mod{S}_1$ and $b=R_2^{-1}·(c_{q}mod{S}_2)mod{S}_2$.

2.

Compute $k=a/b(modp)$. If $bmodp\equiv 0(modp)$, output ⊥.

3.

Solve for x from $k=(f_{1}x+f_0)/(h_{1}x+h_0)(modp)$. If the denominator is zero, output ⊥.

4.

Output the recovered x.

Correctness. Correctness follows directly from the invariant (5): for honestly generated ciphertext with $\delta \left(\mathbf{u}\right)=0(modp)$, decryption recovers $p^{\prime }(x,\mathbf{u})/q^{\prime }(x,\mathbf{u})\equiv \mathsf{\Phi }\left(x\right)(modp)$, and the Möbius transformation $\mathsf{\Phi }\left(x\right)$ is uniquely invertible. The scheme specifies that key generation rejects degenerate polynomial pairs satisfying $f_1{h}_0-f_0{h}_1=0$, which occurs with probability at most $1/p$. The reference implementation does not perform this check, because the probability is below $2^{-128}$ at Level I.

3.4. Key Encapsulation Mechanism via Double Encryption with Consistency Check

We construct a KEM using a double-encryption transform illustrated in Figure 2. The same ephemeral secret x is encapsulated twice under independent randomness, and decapsulation accepts only if the two decrypted values coincide. We prove its IND-CCA2 security in the classical random oracle model, conditional on Assumptions 1, 3, 4, and 5 (Theorem 3). The security proof models the hash function H as a random oracle. The construction is related to generic KEM transformations [31,34], but our proof is specific to the properties of the D-HPPK base PKE. We explain at the end of this subsection why the standard Fujisaki–Okamoto transform does not apply to D-HPPK.

Let $H:{\{0,1\}}^{*}\to {\{0,1\}}^{\ell }$ be a hash function modeled as a random oracle.

Encapsulation $\mathsf{KEM}.\mathsf{Encaps}\left(\mathbf{PK}\right)$.

1.

Sample $x\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$.

2.

Sample two independent noise vectors ${\mathbf{u}}^{\left(1\right)},{\mathbf{u}}^{\left(2\right)}\stackrel{\$}{\leftarrow }\{\mathbf{u}\in {\mathbb{F}}_p^m:\delta \left(\mathbf{u}\right)=0(modp)\}$.

3.

Compute $C^{\left(1\right)}=\mathsf{Enc}(\mathbf{PK},x;{\mathbf{u}}^{\left(1\right)})$ and $C^{\left(2\right)}=\mathsf{Enc}(\mathbf{PK},x;{\mathbf{u}}^{\left(2\right)})$.

4.

Set $C=(C^{\left(1\right)},C^{\left(2\right)})$ and $K=H(x\Vert C^{\left(1\right)}\Vert C^{\left(2\right)})$.

5.

Output $(K,C)$.

Decapsulation $\mathsf{KEM}.\mathsf{Decaps}(\mathbf{SK},C)$.

1.

Parse $C=(C^{\left(1\right)},C^{\left(2\right)})$.

2.

Reject if $C^{\left(1\right)}=C^{\left(2\right)}$ (Class 1).

3.

Reject if $c_p^{\left(1\right)}\equiv c_p^{\left(2\right)}(mod{S}_1)$ and $c_q^{\left(1\right)}\equiv c_q^{\left(2\right)}(mod{S}_2)$ simultaneously (Class 2).

4.

Reject if $C^{\left(2\right)}=\lambda C^{\left(1\right)}$ or $C^{\left(1\right)}=\lambda C^{\left(2\right)}$ for some integer $\lambda$ (Class 3).

5.

Reject if either component of C equals, or is an integer scalar multiple of, the corresponding challenge component (Class 4).

6.

Reject if $gcd(c_p^{\left(1\right)},S_1)\ne 1$, $gcd(c_p^{\left(2\right)},S_1)\ne 1$, $gcd(c_q^{\left(1\right)},S_2)\ne 1$, or $gcd(c_q^{\left(2\right)},S_2)\ne 1$ (Class 5).

7.

Recover $x_1=\mathsf{Dec}(\mathbf{SK},C^{\left(1\right)})$ and $x_2=\mathsf{Dec}(\mathbf{SK},C^{\left(2\right)})$.

8.

If either decryption returns ⊥ or $x_1\ne x_2$, output ⊥.

9.

Otherwise output $K=H(x_1\Vert C^{\left(1\right)}\Vert C^{\left(2\right)})$.

The rejection classes are analysed in Section 4.8. Classes 1 and 3 are testable from the ciphertext alone. Classes 2 and 5 are secret-dependent and are evaluated using the hidden moduli before the main decryption computation. Class 4 is enforced by the IND-CCA2 game rather than by the decapsulation algorithm. In particular, Class 3 closes the integer-scalar-multiple collision channel that would otherwise allow an adversary to obtain a collision with non-negligible probability; Class 5 excludes the degenerate case in which one or both ciphertext components share a factor with the hidden modulus, which would otherwise allow a deterministic collision. The hidden moduli $S_1,S_2$ make residue-preserving shifts (Class 2) infeasible to construct without solving HMPP, and the enlarged rejection set therefore leaves only queries whose decryption outputs collide with probability at most $1/p+\mathrm{negl}\left(\lambda \right)$.

Applicability of the Fujisaki–Okamoto transform. The FO transform [29,30] requires that decapsulation be able to reproduce the encryption of the recovered message using only public information. For D-HPPK this fails: the base PKE encrypts x using an ephemeral $\mathbf{u}$ sampled from the kernel of $\delta$, and $\mathbf{u}$ is discarded. Decapsulation recovers x but not $\mathbf{u}$, so the re-encryption step cannot be executed. Two standard workarounds exist, and both have drawbacks. Derandomizing the encryption (replacing $\mathbf{u}$ with a deterministic function of x) makes re-encryption well-defined but changes the base PKE and invalidates the current ${\mathrm{MRP}}_1$ analysis. Including $\mathbf{u}$ in the ciphertext increases the size by at least $m{log}_{2}p$ bits (384 bits at $l=256$), making the FO ciphertext larger than the double-encryption construction. We therefore adopt the double-encryption construction, which avoids both workarounds at the cost of a $2\times$ ciphertext and a $2\times$ workload.

Table 1 compares the two approaches. The double-encryption construction is the correct choice given the current base PKE. If a future revision derandomizes the encryption and proves the base PKE remains ${\mathrm{MRP}}_1$-hard, the FO transform would halve the ciphertext size. We note this as a direction for future work.

4. Security Analysis of D-HPPK KEM

The security of D-HPPK rests on five assumptions: HMPP (Assumption 1), D-HMPP (Assumption 2), Structured D-HMPP (Assumption 3), MRP in its two forms (Assumption 4), and pairwise decryption-collision resistance (Assumption 5). The security framework is stated in Section 1.2. The technical content of this section is: (i) the search-problem framework (Section 4.1); (ii) the formal games (Section 4.2); (iii) the five assumptions (Section 4.3); (iv) the decryption-safety analysis (Section 4.4); (v) the cryptanalysis of HMPP and MRP (Section 4.5, Section 4.6); (vi) the two-phase key-recovery analysis (Section 4.7); (vii) the rejection set and the IND-CCA2 proof (Section 4.8, Section 4.9); and (viii) the concrete parameters and open problems.

4.1. Search Problems with Efficient Verification

We formalize the security framework in a form that applies to both problems underlying D-HPPK. The notion is standard: it is the framework NIST uses to assign security categories to AES and the framework underlying Merkle’s puzzles [10].

Definition 1 

(Search problem with efficient verification). A search problem with efficient verification is a pair $(\mathcal{X},V)$ where

1.

$\mathcal{X}$ is a finite search space of size $\left|\mathcal{X}\right|=2^l$;

2.

$V:\mathcal{X}\times \mathcal{I}\to \{0,1\}$ is a verification predicate , computable in time $poly\left(L\right)$ for a public parameter L;

3.

a distribution $\mathcal{D}$ over instances such that, for $I\leftarrow \mathcal{D}$, the set $\{x\in \mathcal{X}:V(x,I)=1\}$ is non-empty with overwhelming probability.

The enumeration-verification attack on $(\mathcal{X},V)$ enumerates every $x\in \mathcal{X}$, evaluates $V(x,I)$, and returns the first x with $V(x,I)=1$. Its cost is $O(2^l·poly\left(L\right))$.

Every search problem with efficient verification has a two-phase structure: a non-deterministic guess phase and a deterministic verification phase. This is the same structure as AES key search in the known-ciphertext setting: the guess is a candidate key $k\in {\{0,1\}}^{128}$, and the verification decrypts the public ciphertext under k and checks whether the result is a recognizable plaintext.

Both problems underlying D-HPPK are instances of Definition 1, each with the same two-phase structure. The HMPP instance is verified in Proposition 1 (Section 4.5); the MRP instances are verified in Proposition 4 (Section 4.6). Both share the $2^l$ search-space size and polynomial-time verification, which is why the IND-CCA2 proof must cover both paths via the union bound of Theorem 3.

Figure 3 summarizes the dependency structure. Path A (ephemeral-secret recovery) requires solving ${\mathrm{MRP}}_2$, decomposing into a non-deterministic search over $x\in {\mathbb{F}}_p$ and a deterministic integer verification at cost $O\left(L^2\right)$ per candidate, for total cost $O(2^l·L^2)$. Path B (long-term key recovery) requires solving HMPP (Theorem 2) followed by the polynomial-time Stage 2 projection onto ${\mathbf{d}}^{\perp }$, for cost $O(2^l·poly\left(L\right))$. Structured D-HMPP underpins the adaptive reduction of the pairwise collision assumption (Lemma 3). The collision assumption itself bounds the collision probability of the fixed-pair oracle queries. Paths A and B are subsumed by the union bound of Theorem 3.

4.2. Security Model

We formalize the message-recovery games for the base PKE (single-ciphertext, ${\mathrm{MRP}}_1$; double-ciphertext, ${\mathrm{MRP}}_2$) and the standard IND-CCA2 game for the KEM. The parameter set is $(n,m,p)$ with $l=\lceil {log}_{2}p\rceil$, $n=2$, $m=3$, and $L=2l+8$.

Definition 2 

(Single-ciphertext message-recovery game ${\mathrm{Game}}_{{\mathrm{MR}}_1}$). The challenger runs $(\mathbf{PK},\mathbf{SK})\leftarrow \mathrm{KeyGen}\left(1^{\lambda }\right)$, samples $x^{*}\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$ and ${\mathbf{u}}^{*}\stackrel{\$}{\leftarrow }\{\mathbf{v}\in {\mathbb{F}}_p^m:\delta \left(\mathbf{v}\right)=0\}$, computes $C^{*}=(c_p^{*},c_q^{*})\leftarrow \mathrm{Enc}(\mathbf{PK},x^{*};{\mathbf{u}}^{*})$, and sends $(\mathbf{PK},C^{*})$ to $\mathcal{A}$. The adversary $\mathcal{A}$ wins iff it outputs $\widehat{x}=x^{*}$. The advantage is ${\mathrm{Adv}}_{\mathrm{PKE},\mathcal{A}}^{{\mathrm{mr}}_1}\left(\lambda \right)=Pr[\widehat{x}=x^{*}]$.

Definition 3 

(Double-ciphertext message-recovery game ${\mathrm{Game}}_{{\mathrm{MR}}_2}$). Same as ${\mathrm{Game}}_{{\mathrm{MR}}_1}$ except the challenger samples two independent noise vectors ${\mathbf{u}}^{*,\left(1\right)},{\mathbf{u}}^{*,\left(2\right)}$, computes $C^{\left(i\right)*}=\mathrm{Enc}(\mathbf{PK},x^{*};{\mathbf{u}}^{*,\left(i\right)})$ for $i=1,2$, and sends $(\mathbf{PK},C^{\left(1\right)*},C^{\left(2\right)*})$ to $\mathcal{A}$. The advantage is ${\mathrm{Adv}}_{\mathrm{PKE},\mathcal{A}}^{{\mathrm{mr}}_2}\left(\lambda \right)=Pr[\widehat{x}=x^{*}]$.

Definition 4 

(IND-CCA2 game ${\mathrm{Game}}_{\mathrm{IND}-\mathrm{CCA}2}$). The challenger runs $(\mathbf{PK},\mathbf{SK})\leftarrow \mathrm{KeyGen}\left(1^{\lambda }\right)$ and gives $\mathbf{PK}$ to $\mathcal{A}$, who may query $\mathrm{Decaps}(\mathbf{SK},·)$ adaptively. $\mathcal{A}$ outputs a challenge request; the challenger samples $x^{*}\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$ and ${\mathbf{u}}^{*,\left(1\right)},{\mathbf{u}}^{*,\left(2\right)}$, computes $C^{\left(i\right)*}=\mathrm{Enc}(\mathbf{PK},x^{*};{\mathbf{u}}^{*,\left(i\right)})$, sets $C^{*}=(C^{\left(1\right)*},C^{\left(2\right)*})$, $K_0=H(x^{*}\parallel C^{*})$, samples $K_1\stackrel{\$}{\leftarrow }{\{0,1\}}^{\ell }$, and sends $(C^{*},K_b)$ for $b\stackrel{\$}{\leftarrow }\{0,1\}$. $\mathcal{A}$ may continue querying $\mathrm{Decaps}$ subject to the rejection set $\mathcal{R}$ of Section 4.8, and wins iff $\widehat{b}=b$. The advantage is ${\mathrm{Adv}}_{\mathrm{KEM},\mathcal{A}}^{\mathrm{ind}-\mathrm{cca}2}\left(\lambda \right)=|Pr[\widehat{b}=b]-\frac{1}{2}|$.

4.3. Hardness Assumptions

The following five assumptions are the foundation of the security analysis.

Assumption 1 

(HMPP hardness). For every PPT adversary $\mathcal{B}$,

$${\mathrm{Adv}}_{\mathcal{B}}^{\mathrm{hmpp}}\left(\lambda \right)=Pr\left[\begin{array}{c}(A_1,\dots ,A_t)\leftarrow {\mathcal{D}}_{\mathrm{HMPP}}\left(1^{\lambda }\right);\hfill \\ \widehat{y}\leftarrow \mathcal{B}(A_1,\dots ,A_t)\hfill \end{array}:\widehat{y}=(S,R)\right]\le \mathrm{negl}\left(\lambda \right).$$

Assumption 2 

(Decisional HMPP). For every PPT adversary $\mathcal{B}$,

$$\left|Pr\left[\mathcal{B}(A_1,\dots ,A_t)=1\right]-Pr\left[\mathcal{B}(U_1,\dots ,U_t)=1\right]\right|\le \mathrm{negl}\left(\lambda \right),$$

where $(A_1,\dots ,A_t)\leftarrow {\mathcal{D}}_{\mathrm{HMPP}}\left(1^{\lambda }\right)$ and $(U_1,\dots ,U_t)\stackrel{\$}{\leftarrow }{\left({\mathbb{Z}}_S^{*}\right)}^t$.

Assumption 3 

(Structured D-HMPP). For every PPT adversary $\mathcal{B}$,

$$\left|Pr\left[\mathcal{B}\left(\mathbf{PK}\right)=1\right]-Pr\left[\mathcal{B}\left({\mathbf{PK}}^{\mathrm{ideal}}\right)=1\right]\right|\le \mathrm{negl}\left(\lambda \right),$$

where $\mathbf{PK}$ is generated by $\mathrm{KeyGen}\left(1^{\lambda }\right)$ and ${\mathbf{PK}}^{\mathrm{ideal}}$ replaces the masked public coefficients $({\widehat{P}}_{ij},{\widehat{Q}}_{ij})$ by independent uniform elements of ${\mathbb{Z}}_{S_1}^{*}$ and ${\mathbb{Z}}_{S_2}^{*}$, with the constraint vector $\mathbf{d}$ and all public structure preserved.

On the relationship between HMPP, D-HMPP, and Structured D-HMPP. The standalone D-HMPP of Assumption 2 applies to samples $A_i\equiv R{\tilde{a}}_i(modS)$ with independent uniform ${\tilde{a}}_i$. The D-HPPK public key, however, exposes structured masked coefficients $p_{ij}^{\prime }=p_{ij}^{\left(0\right)}+c_i^{\left(p\right)}{d}_j$ whose joint distribution is determined by the hidden polynomial structure of $p^{\left(0\right)}$ and the rank-one masking. Structured D-HMPP (Assumption 3) is the form actually invoked in the adaptive reduction of Lemma 3; the standalone form of Assumption 2 is used only in the cryptanalysis of Section 4.5 and is a weaker requirement. We state both separately so the reduction does not rely on an implicit extension. Structured D-HMPP is the standard pseudorandomness assumption used in the analysis of ACD-style and hidden-modulus schemes [35,36,40]. The D-HPPK security claim rests on the conjunction of all five assumptions.

On the structured D-HMPP distribution. The masking is designed so that the structured coefficients do not leak the low-dimensional structure of $p^{\left(0\right)}$: the Bézout-combination attack family of Section 4.5.4 shows that the LRA, which breaks the unmasked construction, does not apply to the masked coefficients. Structured D-HMPP asserts that, in addition to not revealing $p^{\left(0\right)}$, the structured coefficients are computationally indistinguishable from independent uniform units of the hidden rings. This is the property required by the hybrid argument of Lemma 3.

Assumption 4 

(MRP hardness). For every PPT adversary $\mathcal{B}$,

$${\mathrm{Adv}}_{\mathcal{B}}^{\mathrm{mrp}}\left(\lambda \right)=max\left\{{\mathrm{Adv}}_{\mathcal{B}}^{{\mathrm{mr}}_1}\left(\lambda \right),{\mathrm{Adv}}_{\mathcal{B}}^{{\mathrm{mr}}_2}\left(\lambda \right)\right\}\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right).$$

On the nature of MRP. MRP is the scheme-induced search problem whose distribution is generated by D-HPPK KeyGen and Enc. By Proposition 4, both formulations are search problems with efficient verification on $\mathcal{X}={\mathbb{F}}_p$ of size $2^l$. The best-known analyzed attack on ${\mathrm{MRP}}_2$ is identical to that on ${\mathrm{MRP}}_1$ up to a constant factor: enumerate $x\in {\mathbb{F}}_p$, solve the linear system for each component’s noise vector, and verify both integer ciphertext identities. We state MRP as an assumption rather than deriving it from a well-studied problem, because no such derivation is currently known. ${\mathrm{MRP}}_2$ is the form actually used by the KEM proof; ${\mathrm{MRP}}_1$ is stated for completeness.

Assumption 5 

(Pairwise decryption-collision resistance). For every fixed ciphertext pair $C^{\left(1\right)}\ne C^{\left(2\right)}$, over the secret-key randomness $(S_1,R_1,S_2,R_2)$,

$$Pr\left[(C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}\wedge \mathrm{Dec}(\mathbf{SK},C^{\left(1\right)})=\mathrm{Dec}(\mathbf{SK},C^{\left(2\right)})\right]\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right),$$

except for pairs $(C^{\left(1\right)},C^{\left(2\right)})$ generated as two honest encryptions of the same plaintext under $\mathrm{Enc}$.

On the nature of Assumption 5. The assumption is stated in joint form: the probability that a fixed ciphertext pair is both admissible (outside $\mathcal{R}$) and colliding is at most $1/p+\mathrm{negl}\left(\lambda \right)$. This avoids a conditioning subtlety, because $\mathcal{R}$ contains the secret-dependent Classes 2 and 5, so admissibility itself depends on the secret-key sample; a conditional formulation would require the adversary to know the secret-dependent admissibility of its query, which is not the case in the game. The joint form automatically accounts for the cases in which a candidate pair is rejected by Class 2 or Class 5, since those events contribute to the complementary probability $(C^{\left(1\right)},C^{\left(2\right)})\in \mathcal{R}$ and are not counted.

The assumption is scheme-induced: its instance distribution is determined by KeyGen and Enc, and it is a companion to ${\mathrm{MRP}}_2$. Where ${\mathrm{MRP}}_2$ says that the adversary cannot recover $x^{*}$ from the challenge pair, Assumption 5 says that the adversary cannot even produce a distinct admissible pair that decapsulation would accept as consistent. The assumption is consistent with Lemma 1, which shows that the marginal law of each decryption output is close to uniform; it additionally posits near-independence of the two outputs, which is the genuinely two-dimensional statement not proved here. We invite cryptanalysis on this point.

4.4. Decryption-Safety Properties

This subsection establishes the decryption-safety properties used by the IND-CCA2 proof: a marginal statistical-uniformity result for the decryption output (Lemmas 1 and 2) and the pairwise decryption-collision assumption for distinct ciphertext pairs outside the rejection set $\mathcal{R}$ (Assumption 5, stated in Section 4.3). We give a short hybrid reduction that derives the adaptive property from the fixed-pair assumption through Structured D-HMPP (Lemma 3). We state the pairwise property as an assumption rather than deriving it from the one-dimensional modular-reduction lemmas, because establishing the joint near-independence of two decryption outputs directly from the hidden-ring structure is a genuinely two-dimensional equidistribution problem that we leave for future analysis (Section 6); the one-dimensional marginal uniformity is proved.

4.4.1. Analytic Preliminaries

The two lemmas below establish the statistical ingredients underlying the marginal uniformity of the decryption output for a fixed admissible ciphertext: Lemma 1 gives near-uniformity of each reduced intermediate, and Lemma 2 transfers near-uniformity through the field division that produces the decryption output.

Lemma 1 

(Modular-reduction uniformity). Let p be prime, let $S>9p^2$ be an L-bit integer, and let c be an integer with $gcd(c,S)=1$. Let Y be uniform on ${\mathbb{Z}}_S^{*}$. Then

$$\Delta \left((cYmodS)modp,U\left({\mathbb{F}}_p\right)\right)\le {\displaystyle \frac{c_0}{p}},$$

where $c_0=2^{O(L/logL)}O(logL)$ is sub-exponential in L. In particular, $c_0/p=2^{-\Omega \left(L\right)}$ for the D-HPPK parameter relation $L=2l+8$ with p an l-bit prime.

Proof. 

Case 1: $gcd(S,p)=1$. Since $gcd(c,S)=1$, multiplication by c is a permutation of ${\mathbb{Z}}_S^{*}$. Hence $a=cYmodS$ is uniform on ${\mathbb{Z}}_S^{*}$. For each $r\in {\mathbb{F}}_p$, let $N_r=\left|\{y\in {\mathbb{Z}}_S^{*}:y\equiv r(modp)\}\right|$. By inclusion–exclusion over the squarefree divisors of S,

$$N_r={\displaystyle \frac{\phi \left(S\right)}{p}}+{\eta }_r,\left|{\eta }_r\right|\le 2^{\omega \left(S\right)}.$$

Therefore

$$\Delta \left(amodp,U\left({\mathbb{F}}_p\right)\right)\le {\displaystyle \frac{p{2}^{\omega \left(S\right)-1}}{\phi \left(S\right)}}.$$

By the maximal-order theorem for $\omega \left(S\right)$ [41], $\omega \left(S\right)=O(logS/loglogS)$, so $2^{\omega \left(S\right)}=2^{O(L/logL)}$. Using the standard lower bound on $\phi \left(S\right)$ and $S>9p^2$,

$$\Delta \left(amodp,U\left({\mathbb{F}}_p\right)\right)\le {\displaystyle \frac{2^{O(L/logL)}O(logL)}{p}}.$$

Thus $c_0=2^{O(L/logL)}O(logL)$ is sub-exponential in L.

Case 2: $p\mid S$. Write $S=p{S}^{\prime }$. Since $gcd(c,S)=1$ and $Y\in {\mathbb{Z}}_S^{*}$, we have $p\nmid cY$, so $(cYmodS)modp=cYmodp$. Multiplication by c is a bijection on ${\mathbb{F}}_p^{*}$, so $cYmodp$ is uniform on ${\mathbb{F}}_p^{*}$, and

$$\Delta \left((cYmodS)modp,U\left({\mathbb{F}}_p\right)\right)={\displaystyle \frac{1}{p}}.$$

Combining both cases. The bound $\Delta \le c_0/p$ holds with $c_0=2^{O(L/logL)}O(logL)$. For $L=2l+8$, with $p\ge 2^{l-1}=2^{L/2-5}$, Case 1 gives $c_0/p\le 2^{-\Omega \left(L\right)}$ and Case 2 gives $1/p=2^{-\Omega \left(L\right)}$.    □

Lemma 2 

(Ratio of nearly-uniform variables). Let $X,Y$ be independent random variables on ${\mathbb{F}}_p$ with $\Delta (X,U)\le \epsilon$ and $\Delta (Y,U)\le \epsilon$. Define $Z=X/Y$ when $Y\ne 0$ and $Z=0$ otherwise, with the convention that $X/Y$ is computed in ${\mathbb{F}}_p$. Then

$$\Delta (Z,U)\le 2\epsilon +{\displaystyle \frac{p-1}{p^2}}<2\epsilon +{\displaystyle \frac{1}{p}}.$$

Proof. 

Let $(X^{\prime },Y^{\prime })$ be independent and uniform on ${\mathbb{F}}_p^2$, and define $Z^{\prime }$ from $(X^{\prime },Y^{\prime })$ as Z is defined from $(X,Y)$. By the product bound for total variation, $\Delta ((X,Y),(X^{\prime },Y^{\prime }))\le 2\epsilon$. The data-processing inequality gives $\Delta (Z,Z^{\prime })\le 2\epsilon$. For $z\ne 0$, $Pr[Z^{\prime }=z]=(p-1)/p^2$, and $Pr[Z^{\prime }=0]=(2p-1)/p^2$, so $\Delta (Z^{\prime },U)=(p-1)/p^2$. The triangle inequality yields the stated bound.    □

4.4.2. Pairwise Decryption-Collision

We invoke Assumption 5 and derive its adaptive form. The assumption is stated for fixed ciphertext pairs outside the rejection set $\mathcal{R}$, with the probability taken over the secret-key randomness. The adaptive version, in which the adversary chooses the pair as a function of $\mathbf{PK}$, is reduced to the fixed version by Structured D-HMPP (Lemma 3).

Lemma 3 

(Adaptive collision from the fixed-pair assumption). Assume Structured D-HMPP (Assumption 3) and Assumption 5. Then for every PPT adversary $\mathcal{A}$ that outputs a pair $C^{\left(1\right)}\ne C^{\left(2\right)}$ outside the rejection set $\mathcal{R}$,

$$Pr\left[\mathrm{Dec}(\mathbf{SK},C^{\left(1\right)})=\mathrm{Dec}(\mathbf{SK},C^{\left(2\right)})\right]\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right),$$

unless both $C^{\left(1\right)}$ and $C^{\left(2\right)}$ are honest encryptions of a common plaintext known to $\mathcal{A}$.

Proof. 

Hybrid 0 (real).$(\mathbf{PK},\mathbf{SK})\leftarrow \mathrm{KeyGen}$, $(C^{\left(1\right)},C^{\left(2\right)})\leftarrow \mathcal{A}\left(\mathbf{PK}\right)$.

Hybrid 1 (ideal public key). Replace the masked public coefficients $({\widehat{P}}_{ij},{\widehat{Q}}_{ij})$ by uniform independent elements of ${\mathbb{Z}}_{S_1}^{*},{\mathbb{Z}}_{S_2}^{*}$, keeping the constraint vector $\mathbf{d}$ and all other public structure unchanged. By Assumption 3, Hybrid 0 and Hybrid 1 are computationally indistinguishable, so the joint distribution of $\left(\mathcal{A}\right(\mathbf{PK}),\mathrm{Dec}(\mathbf{SK},·\left)\right)$ changes by at most $\mathrm{negl}\left(\lambda \right)$.

Hybrid 2 (independent secret key). In the ideal world, the public key is independent of $(S_1,R_1,S_2,R_2)$. Condition on ${\mathbf{PK}}^{\mathrm{ideal}}$ and on $(C^{\left(1\right)},C^{\left(2\right)})=\mathcal{A}\left({\mathbf{PK}}^{\mathrm{ideal}}\right)$; the secret-key randomness remains uniform and independent of the conditioning. Assumption 5 then gives

$$Pr\left[(C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}\wedge \mathrm{Dec}\left(C^{\left(1\right)}\right)=\mathrm{Dec}\left(C^{\left(2\right)}\right)\right]\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right).$$

Conditioning on the admissible event $(C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}$ — which has probability bounded below by a non-negligible quantity in the relevant game regime — yields the conditional bound $Pr[\mathrm{Dec}\left(C^{\left(1\right)}\right)=\mathrm{Dec}\left(C^{\left(2\right)}\right)\mid (C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}]\le 1/p+\mathrm{negl}\left(\lambda \right)$. Combining the two hybrid transitions yields the stated bound. The excluded honest-double-encryption case is handled as in Corollary 1.    □

4.5. Hidden Modulus Product Problem

Definition 5 

(HMPP instance distribution). Let p be the public prime with $l=\lceil {log}_{2}p\rceil$, let L be an integer with $L>2l$, and let $t\ge 3$. The instance distribution ${\mathcal{D}}_{\mathrm{HMPP}}\left(1^{\lambda }\right)$ proceeds as follows:

1. 

Sample a secret modulus S uniformly from the set of L-bit integers satisfying $S>9p^2$. This is the same distribution as $\mathrm{KeyGen}$ (Section 3.1); HMPP instances are therefore drawn from the exact distribution that D-HPPK uses, and the assumption is not strengthened by enlarging the instance set.

2. 

Sample a secret coprime multiplier $R\stackrel{\$}{\leftarrow }{\mathbb{Z}}_S^{*}$.

3. 

For $i=1,\dots ,t$, sample $a_i\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$ uniformly, and let ${\tilde{a}}_i\in [0,p-1]$ denote its canonical integer representative.

4. 

Compute the public samples $A_i\equiv R·{\tilde{a}}_i(modS)$.

The secret trapdoor is $(S,R,a_1,\dots ,a_t)$. The public instance is $(A_1,\dots ,A_t)$.

Definition 6 

(D-HMPP instance distribution). The D-HMPP experiment proceeds as follows.

1. 

Sample a secret modulus S uniformly from the L-bit integers satisfying $S>9p^2$, matching the HMPP instance distribution of Definition 5.

2. 

With probability $1/2$, sample a secret multiplier $R\stackrel{\$}{\leftarrow }{\mathbb{Z}}_S^{*}$ and independent $a_i\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$, and set $A_i\equiv R{\tilde{a}}_i(modS)$ for $i=1,\dots ,t$.

3. 

Otherwise, sample $A_i\stackrel{\$}{\leftarrow }{\mathbb{Z}}_S^{*}$ independently and uniformly for $i=1,\dots ,t$.

The adversary receives $(A_1,\dots ,A_t)$ and outputs a bit $\widehat{b}$. The D-HMPP advantage is

$$\left|Pr[\widehat{b}=1\mid \mathrm{structured}]-Pr[\widehat{b}=1\mid \mathrm{uniform}]\right|.$$

The modulus S is not given to the adversary; it is part of the secret trapdoor, exactly as in Definition 5.

HMPP is a new problem introduced in this work, related in spirit to ACD [35,36,38,40] but differing in that a single large multiplier $R\in {\mathbb{Z}}_S^{*}$ acts on all small values ${\tilde{a}}_i\in [0,p-1]$, and the resulting samples are uniform residues modulo S. We examine five attack families below, and identify a sixth class (full-sample lattice attacks) as open for further cryptanalysis.

Proposition 1 

(HMPP is a search problem with efficient verification). Under the heuristic lattice model of Proposition 3, HMPP has the two-phase structure of Definition 1. The guess phase is a non-deterministic choice of ${\widehat{a}}_1\in [0,p-1]$, of size $2^{l-1}\le \left|\mathcal{X}\right|\le 2^l$. The verification phase applies lattice reduction to recover a candidate $(S,R)$, then checks $R{\tilde{a}}_i\equiv A_i(modS)$ for all i, in $O(t·poly(L\left)\right)$ bit operations.

4.5.1. Elementary GCD Attack (Rigorous)

Proposition 2 

(Elementary attack on HMPP). For $t\ge 3$, there is an elementary algorithm that recovers $(S,R)$ from $(A_1,\dots ,A_t)$ in time $O(2^{2l}·poly\left(L\right))$ classically.

Proof. 

Fix guesses ${\widehat{a}}_1,{\widehat{a}}_j\in [0,p-1]$ for two of the small values, $j\in \{2,\dots ,t\}$. If both guesses are correct, $B_j=A_1{\widehat{a}}_j-A_j{\widehat{a}}_1$ is a nonzero multiple of S. Taking gcds over several j isolates S up to a small cofactor. Once S and $a_1$ are known, $R=A_1{a}_1^{-1}modS$ and $a_j=A_j{R}^{-1}modS$. Wrong guesses are rejected by the consistency check. The dominant cost is the search over $({\widehat{a}}_1,{\widehat{a}}_j)$.    □

4.5.2. Lattice Attack (Heuristic)

A single-guess lattice attack has been proposed in the ACD literature. It reduces the guess space by half, at the cost of a lattice-reduction step whose applicability to HMPP is not proven.

Proposition 3 

(Heuristic lattice attack on HMPP). If the ACD lattice template applies to the HMPP instance distribution, there is a classical algorithm that recovers $(S,R)$ in time $O(2^l·poly\left(L\right))$.

Proof. 

Fix a guess ${\widehat{a}}_1\in [0,p-1]$. For the correct guess, $B_j=A_1{\tilde{a}}_j-A_j{\widehat{a}}_1$ is a multiple of S for all j. Under the heuristic assumption that the ACD template applies, a lattice of dimension t constructed from the public values and a scaling factor $2^{\rho }$ with $\rho \approx L$ contains the vector $({\tilde{a}}_2,\dots ,{\tilde{a}}_t,S)$ as a short vector, which LLL/BKZ recovers in $poly\left(L\right)$ time. The dominant cost is the search over ${\widehat{a}}_1$.    □

The proposition is conditional. If the ACD template applies, the best-known attack costs $O(2^l·poly\left(L\right))$; if it does not, the rigorous fallback is the elementary GCD attack of Proposition 2 at $O(2^{2l}·poly\left(L\right))$. The true best attack lies in the range $[2^l,2^{2l}]$. Parameter selection (Section 5.1) adopts the $2^l$ bound, so the claimed security level holds even if the heuristic is optimistic. The ACD template is not proven to apply: the standard technique requires small residues modulo the unknown modulus, whereas the HMPP residues $A_{i}modS$ are uniform in the image of the multiplication-by-R map, and eliminating R requires knowing S. Whether the technique can be adapted is open (Section 4.12).

4.5.3. Algebraic and Statistical Attacks (No Improvement)

We examined three algebraic attack families. Rational reconstruction exploits the relation $A_i/A_j\equiv {\tilde{a}}_i/{\tilde{a}}_j(modS)$, but reducing the fractions modulo S requires knowing S; without it, the relation is uninformative. Simultaneous modular relations uses the products $A_i{\tilde{a}}_j-A_j{\tilde{a}}_i$, which are multiples of S; eliminating S between two such products yields a bilinear relation in the unknown small values that does not isolate S. Gröbner basis techniques do not apply directly because the defining relations are congruences over $\mathbb{Z}$, not equations over a field. We found no algebraic attack that improves upon the elementary bound of Proposition 2.

We examined three statistical attack families. Cofactor leakage does not apply because the quotients $k_i=\lfloor R{\tilde{a}}_i/S\rfloor$ are uniform over a wide range and reveal nothing about S. GCD-based combinations do not isolate S because the products $A_i{A}_j$ are uniform modulo S up to the shared factor $R^2$. Small-coefficient bias is defeated by the injectivity of multiplication by R: in the generic case $gcd(S,p)=1$, the image set ${\mathcal{I}}_R=\{R\tilde{a}modS:\tilde{a}\in [0,p-1]\}$ has exactly p elements and density $p/S\approx 2^{-l-8}$, so no residue is preferred. We found no statistical attack that improves upon the elementary GCD bound of Proposition 2.

4.5.4. Bézout-Combination Attacks (Blocked by Masking)

The Lattice Reconstitution Attack (LRA) [9] recovers the secret key of the unmasked HPPK KEM in polynomial time. D-HPPK applies additive random masking before hidden-ring embedding, producing masked coefficients $p_{ij}^{\prime }=p_{ij}^{\left(0\right)}+c_i^{\left(p\right)}{d}_j$. The rank-one perturbation destroys the rank-two structure of $p^{\left(0\right)}$, and for $m=n+1$ the masked matrix is generically full-rank. The Bézout-combination construction that underlies the LRA therefore does not yield a usable discriminator on D-HPPK public samples.

4.5.5. Full-Sample Lattice Attacks (Open)

Using all t samples simultaneously is the strongest known approach to ACD [35,36]; whether this technique applies to HMPP, and with what complexity, is left open in Section 4.12.

4.5.6. Best-Known Attack Summary

The attacks surveyed above are summarized in Table 2. The strongest candidate attack is the heuristic lattice attack at $O(2^l·poly\left(L\right))$; the rigorous fallback is the elementary GCD attack at $O(2^{2l}·poly\left(L\right))$. The remaining attack families either do not improve on these bounds or are blocked by the masking. Parameter selection adopts the $2^l$ bound (Section 5.1).

4.6. Message Recovery Problem

The problem an adversary faces against D-HPPK has two formulations. At the mathematical level, inverting a system of polynomial congruences over ${\mathbb{F}}_p$ is the Modular Multivariate Polynomial System (MMPS). It is parameterized only by the number of equations k, the number of unknowns $m+1$, and the degrees of the coefficient polynomials. At the scheme level, the ciphertext recovery problem is the Message Recovery Problem (MRP) of Definitions 2 and 3. MRP is scheme-induced: its instance distribution references KeyGen and Enc, it inherits the constraint ${\mathbf{d}}^{\top }\mathbf{u}\equiv 0(modp)$, and its integer ciphertext identity retains the unreduced hidden-modulus information that pins down $x^{*}$.

MRP reduces to MMPS by reducing the ciphertext equations modulo p and appending the constraint. The hardness assumption is placed on MRP, not on the generic MMPS problem, because the modular system admits a solution for every free variable x and therefore does not by itself distinguish the true secret $x^{*}$ (Section 4.6.4).

4.6.1. The Generic MMPS Problem

Definition 7 

(MMPS). Let p be prime with $l=\lceil {log}_{2}p\rceil$, and let $n,m,k\ge 1$. An MMPS instance is a system of k polynomial congruences over ${\mathbb{F}}_p$ in $m+1$ unknowns $(x,u_1,\dots ,u_m)$,

$$h_{\ell }(x,u_1,\dots ,u_m)\equiv b_{\ell }(modp),\ell =1,\dots ,k,$$

where each $h_{\ell }$ is linear in $(u_1,\dots ,u_m)$ and polynomial in x of degree at most n:

$$h_{\ell }(x,\mathbf{u})={\displaystyle \sum _{j=1}^m}{f}_{\ell ,j}\left(x\right)u_j,f_{\ell ,j}\left(x\right)={\displaystyle \sum _{i=0}^n}{c}_{\ell ,j,i}{x}^i,$$

with $c_{\ell ,j,i},b_{\ell }\in {\mathbb{F}}_p$. TheMMPS problemis: given a valid MMPS instance, output $x^{*}\in {\mathbb{F}}_p$ for which the system admits a solution $(u_1^{*},\dots ,u_m^{*})\in {\mathbb{F}}_p^m$.

The D-HPPK instantiation has $k=3$ equations in $m+1$ unknowns: one constraint constant in x, and one equation from each of $c_p$ and $c_q$. At the default parameters $m=3$, the system is underdetermined by exactly one variable (x), and the solution variety has dimension one. For each fixed candidate x, the system reduces to three equations in $(u_1,u_2,u_3)$, which is generically determined.

Remark 1 

(Why MMPS is a natural problem). MMPS belongs to the well-studied class of structured polynomial systems over finite fields [23,24,25,26,27]. The D-HPPK instantiation differs from these generic constructions in its coefficient distribution and in the specific structure exploited by the enumeration-verification procedure described in Section 4.6.3.

4.6.2. MRP: The Scheme-Induced Message Recovery Problem

Definition 8 

(${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$ instance distributions). The single-ciphertext instance distribution ${\mathcal{D}}_{{\mathrm{MRP}}_1}\left(1^{\lambda }\right)$ runs $(\mathbf{PK},\mathbf{SK})\leftarrow \mathrm{KeyGen}\left(1^{\lambda }\right)$, samples $x^{*}\stackrel{\$}{\leftarrow }{\mathbb{F}}_p$ and ${\mathbf{u}}^{*}\stackrel{\$}{\leftarrow }\{\mathbf{v}\in {\mathbb{F}}_p^m:{\mathbf{d}}^{\top }\mathbf{v}=0\}$, computes $C^{*}\leftarrow \mathrm{Enc}(\mathbf{PK},x^{*};{\mathbf{u}}^{*})$, and outputs the instance $(\mathbf{PK},C^{*})$ and the secret $x^{*}$. The double-ciphertext instance distribution ${\mathcal{D}}_{{\mathrm{MRP}}_2}\left(1^{\lambda }\right)$ is identical except it samples two independent noise vectors ${\mathbf{u}}^{*,\left(1\right)},{\mathbf{u}}^{*,\left(2\right)}$ and outputs $(\mathbf{PK},C^{\left(1\right)*},C^{\left(2\right)*})$.

The ciphertext identity is exact over the integers:

$$\begin{array}{cc}\hfill c_p^{*}& ={\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\widehat{P}}_{ij}\left(x^{*i}{u}_j^{*}modp\right),\hfill \\ \hfill c_q^{*}& ={\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\widehat{Q}}_{ij}\left(x^{*i}{u}_j^{*}modp\right).\hfill \end{array}$$

(9)

The integer structure is what distinguishes MRP from its modular reduction and is the only place where the hidden-modulus information is retained.

Proposition 4 

(MRP is a search problem with efficient verification). Both ${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$ have the two-phase structure of Definition 1. The guess phase is a non-deterministic choice of a single $x\in \mathcal{X}={\mathbb{F}}_p$ of size $2^l$. The verification predicate $V(x,C)$ is defined as follows. If $M\left(x\right)$ is invertible, compute $\mathbf{u}\left(x\right)=M{\left(x\right)}^{-1}\mathbf{b}$ and check the integer ciphertext identity (9); output 1 if it holds and 0 otherwise. If $M\left(x\right)$ is singular, output 0. The determinant $detM\left(x\right)$ vanishes for at most 4 values of x, so the exceptional cases remove at most 4 candidates from the search space and do not affect the asymptotic cost.

For ${\mathrm{MRP}}_1$, the verification is $O\left(L^2\right)$ bit operations. For ${\mathrm{MRP}}_2$, the same guess x is used to verify both components, each at $O\left(L^2\right)$ bit operations, for a total of $O\left(L^2\right)$ up to a constant factor of two. The search space in both cases is $2^l$ up to an additive constant; only the verification cost differs by a constant.

4.6.3. Reduction to MMPS and Complexity

An MRP instance determines an MMPS instance by reducing the ciphertext equations modulo p and appending the constraint. Let ${\overline{p}}_{ij}={\widehat{P}}_{ij}modp$, ${\overline{q}}_{ij}={\widehat{Q}}_{ij}modp$, ${\overline{c}}_p=c_p^{*}modp$, and ${\overline{c}}_q=c_q^{*}modp$. The resulting MMPS instance has $k=3$ equations in $m+1$ unknowns:

$$\begin{array}{cc}\hfill {\displaystyle \sum _{j=1}^m}{d}_j{u}_j& \equiv 0(modp),\hfill \\ \hfill {\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\overline{p}}_{ij}{x}^i{u}_j& \equiv {\overline{c}}_p(modp),\hfill \\ \hfill {\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=1}^m}{\overline{q}}_{ij}{x}^i{u}_j& \equiv {\overline{c}}_q(modp).\hfill \end{array}$$

(10)

Lemma 4 

(MRP solutions reduce to MMPS solutions). If $(x^{*},{\mathbf{u}}^{*})$ satisfies the MRP integer identity (9), then its reduction modulo p satisfies the MMPS system (10).

Proof. 

Reduction modulo p is a ring homomorphism from $\mathbb{Z}$ to ${\mathbb{F}}_p$. The reverse direction does not hold in general: an MMPS solution need not lift to an MRP solution.    □

Theorem 1 

(Complexity of MRP and of the D-HPPK MMPS sub-family). At $m=3$, the best-known analyzed attack on both ${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$, equivalently on MMPS instances of the D-HPPK form (10), has running time $O(2^l·L^2)$ classical bit operations. This is an upper bound established by exhaustive search; no matching lower bound is claimed. For $m>3$, the asymptotic complexity remains $O(2^l·\mathrm{poly}\left(L\right))$.

Proof. 

For each fixed guess $\widehat{x}\in {\mathbb{F}}_p$, the system (10) becomes three linear equations in the three unknowns $u_1,u_2,u_3$. If the coefficient matrix $M\left(\widehat{x}\right)$ is non-singular, the system has a unique solution $\mathbf{u}$, which is then verified against the integer identity (9) at cost $O\left(L^2\right)$ bit operations. The determinant $detM\left(x\right)$ vanishes for at most 4 values of $\widehat{x}$, handled by a constant-size exception list. For ${\mathrm{MRP}}_2$, the procedure is applied to each component; the cost doubles, which does not change the O class. The search is over $2^l$ candidates.    □

The two-phase structure makes the complexity chain explicit:

$$\underset{\mathrm{MMPS}\mathrm{search}\mathrm{over}x}{\underbrace{O\left(2^l\right)}}\times \underset{\mathrm{integer}\mathrm{verification}}{\underbrace{O\left(L^2\right)}}=O(2^l·L^2).$$

Under the search-based convention of Section 1.2, the security level of D-HPPK is l bits, determined by the size of the search space $|{\mathbb{F}}_p|=2^l$ and the $O\left(L^2\right)$-time verification.

Message-recovery security of the base PKE. By construction, the hardness of ${\mathrm{MRP}}_1$ is the message-recovery security of the base PKE: the single-ciphertext game of Definition 2 and the ${\mathrm{MRP}}_1$ instance distribution of Definition 8 are generated by the same KeyGen and Enc algorithms. The identification is definitional, not a reduction: ${\mathrm{MRP}}_1$ hardness is the message-recovery security property of the base PKE under the search-based convention of Section 1.2. The double-ciphertext formulation ${\mathrm{MRP}}_2$ is the form used by the IND-CCA2 proof of Section 4.9, and has the same $O(2^l·L^2)$ best-known analyzed attack cost by Theorem 1.

4.6.4. Algebraic Attacks: Trivial Elimination Ideal

We bound the degree of regularity of the D-HPPK sub-family of MMPS. Let $I=\langle g_1,g_2,g_3\rangle \subset {\mathbb{F}}_p[x,u_1,u_2,u_3]$ denote the ideal generated by the system (10), and write the system in matrix form $M\left(x\right)\mathbf{u}=\mathbf{b}$, where $\mathbf{b}={(0,{\overline{c}}_p,{\overline{c}}_q)}^{\top }\in {\mathbb{F}}_p^3$.

The variety $V\left(I\right)$ is one-dimensional. For each x at which $M\left(x\right)$ is invertible, the system has a unique solution $\mathbf{u}\left(x\right)$. The determinant $detM\left(x\right)$ vanishes for at most 4 values of x. For all other x, the projection $V\left(I\right)\to {\mathbb{A}}_x^1$ is a bijection, so $V\left(I\right)$ is a rational curve parameterized by x and has dimension 1.

Degree bound on the rational parametrization. Because the system is linear in $\mathbf{u}$, the Gröbner basis is computable by Gaussian elimination over ${\mathbb{F}}_p\left(x\right)$. The Leibniz expansion gives $degdetM\left(x\right)\le 4$, and each entry of $adjM\left(x\right)$ is of degree at most 4 in x. Consequently the rational parametrization $x\mapsto \mathbf{u}\left(x\right)$ has numerator and denominator degree at most 4, and Gröbner elimination introduces no high-degree condition that isolates x. We do not claim a Castelnuovo–Mumford regularity bound for the ideal I; the degree bound on the parametrization is what the cryptanalysis requires.

The elimination ideal is trivial. The elimination ideal $I\cap {\mathbb{F}}_p\left[x\right]$ is the zero ideal, because the projection $V\left(I\right)\to {\mathbb{A}}_x^1$ is surjective: every $x\in {\mathbb{F}}_p$ is the x-coordinate of some solution. Consequently, the adversary who computes the Gröbner basis learns nothing about the true $x^{*}$ from the modular system alone. To recover $x^{*}$, the adversary must use the integer ciphertext identity (9) and enumerate over all $x\in {\mathbb{F}}_p$. This is why the search is over $x\in {\mathbb{F}}_p$ rather than over the algebraic variety, and why the hardness assumption is placed on MRP rather than on the generic MMPS problem.

4.7. Key Recovery: Two-Phase Attack

Recovering the long-term secret key from the public key decomposes into two stages: first breaking the hidden rings, then exploiting the factorization structure of the underlying coefficient matrices. The first stage is HMPP; the second is polynomial. Consequently the total key-recovery cost coincides with the HMPP cost, and Theorem 2 below makes this precise.

Stage 1: Breaking the hidden rings (HMPP). The public key contains two HMPP instances: $\left\{{\widehat{P}}_{ij}\right\}$ with modulus $S_1$ and multiplier $R_1$, and $\left\{{\widehat{Q}}_{ij}\right\}$ with modulus $S_2$ and multiplier $R_2$. The standalone cryptanalysis of Section 4.5 establishes that the best currently analyzed attack on HMPP has classical cost $O(2^l·poly\left(L\right))$, conditional on the ACD-template heuristic, with the rigorous elementary GCD fallback at $O(2^{2l}·poly\left(L\right))$. The purpose of the present subsection is to show that once HMPP is broken, the remaining factorization recovery is polynomial, so the total key-recovery cost coincides with the HMPP cost.

Stage 2: Recovering the factorization. After Stage 1, the adversary knows ${\mathbf{p}}^{\prime }={\mathbf{p}}^{\left(0\right)}+{\mathbf{c}}^{\left(p\right)}{\mathbf{d}}^{\top }$ and ${\mathbf{q}}^{\prime }={\mathbf{q}}^{\left(0\right)}+{\mathbf{c}}^{\left(q\right)}{\mathbf{d}}^{\top }$. Let $\mathbf{v}\in {\mathbb{F}}_p^m$ be nonzero with ${\mathbf{d}}^{\top }\mathbf{v}=0$. Then ${\mathbf{p}}^{\prime }\mathbf{v}={\mathbf{p}}^{\left(0\right)}\mathbf{v}$, and likewise for ${\mathbf{q}}^{\prime }$. Since ${\mathbf{p}}^{\left(0\right)}={\mathbf{F}}_p\mathbf{B}$ and ${\mathbf{q}}^{\left(0\right)}={\mathbf{F}}_h\mathbf{B}$, the projection gives

$${\mathbf{p}}^{\prime }\mathbf{v}={\mathbf{F}}_p\left(\mathbf{B}\mathbf{v}\right),{\mathbf{q}}^{\prime }\mathbf{v}={\mathbf{F}}_h\left(\mathbf{B}\mathbf{v}\right),$$

i.e., a pair of column vectors proportional to the coefficient vectors of f and h, up to unknown scalars. Taking a second, linearly independent ${\mathbf{v}}^{\prime }\in {\mathbf{d}}^{\perp }$ recovers the ratio and hence the full Möbius transformation $\mathsf{\Phi }\left(x\right)=f\left(x\right)/h\left(x\right)$ in $O\left(1\right)$ field operations. This requires the nondegeneracy condition that the projected vectors $(\mathbf{B}{\mathbf{v}}_1,\mathbf{B}{\mathbf{v}}_2)$ span a rank-two subspace and that the resulting linear system for the scale ratio has nonzero determinant. The condition holds for generic $\mathbf{B}$ and fails only on a measure-zero subset of key space; if it fails, key regeneration produces a valid key.

Lemma 5 

(Polynomial-time key recovery after HMPP). Given ${\mathbf{p}}^{\prime },{\mathbf{q}}^{\prime }$, and $\mathbf{d}$, the secret polynomials $f\left(x\right)$ and $h\left(x\right)$ are recoverable in $O(poly(L\left)\right)$ field operations.

Proof. 

Choose a basis $({\mathbf{v}}_1,{\mathbf{v}}_2)$ of ${\mathbf{d}}^{\perp }$. The projections ${\mathbf{p}}^{\prime }{\mathbf{v}}_k={\mathbf{F}}_p\left(\mathbf{B}{\mathbf{v}}_k\right)$ and ${\mathbf{q}}^{\prime }{\mathbf{v}}_k={\mathbf{F}}_h\left(\mathbf{B}{\mathbf{v}}_k\right)$, $k=1,2$, are computable in $O\left(m\right)$ field operations. The column space of $({\mathbf{p}}^{\prime }{\mathbf{v}}_1,{\mathbf{p}}^{\prime }{\mathbf{v}}_2)$ equals the column space of ${\mathbf{F}}_p$, whose left null vector is proportional to ${\mathbf{u}}_f={(f_1^2,-f_0{f}_1,f_0^2)}^{\top }$. The same holds for ${\mathbf{q}}^{\prime }$ with ${\mathbf{u}}_h={(h_1^2,-h_0{h}_1,h_0^2)}^{\top }$. The shared factor $\mathbf{B}$ fixes the relative scale, so comparing the recovered ratios $f_0/f_1$ and $h_0/h_1$ determines the full Möbius transformation in $O\left(1\right)$ field operations. The comparison is well-defined whenever $f_1{h}_0-f_0{h}_1\ne 0$, which is the nondegeneracy condition enforced by the KeyGen rejection described in Section 3.3.    □

Theorem 2 

(Key-recovery complexity). Under Assumption 1, the best-known classical complexity of key recovery is $O(2^l·poly\left(L\right))$, matching the best-known secret-recovery cost of MRP.

Proof. 

Stage 1 is bounded by Assumption 1. Stage 2 is polynomial by Lemma 5.    □

4.8. Rejection Set and Formal Justification

The property required by the IND-CCA2 proof is the pairwise decryption-collision assumption (Assumption 5), with its adaptive form provided by Lemma 3. The rejection set $\mathcal{R}$ comprises five classes. Classes 1 and 3 are computable from the ciphertext alone; Classes 2 and 5 are secret-dependent, evaluated using $S_1,S_2$; and Class 4 is enforced by the IND-CCA2 game.

Class 1 (duplicate components):$C=(D,D)$; rejected by direct comparison.

Class 2 (residue-preserving shifts):$c_p^{\left(1\right)}\equiv c_p^{\left(2\right)}(mod{S}_1)$ and $c_q^{\left(1\right)}\equiv c_q^{\left(2\right)}(mod{S}_2)$ simultaneously. A direct construction of such a pair requires knowledge of $S_1,S_2$, and under the current analysis this appears to require solving an HMPP-type hidden-modulus problem; we do not claim a proof that every construction must recover the moduli. Because $S_i>9p^2$ while $c_p<9p{S}_1$ and $c_q<9p{S}_2$, any residue-preserving shift is necessarily a small multiple of the hidden modulus, and the moduli are not otherwise observable from the public key.

Class 3 (integer scalar multiples):$C^{\left(2\right)}=\lambda C^{\left(1\right)}$ or $C^{\left(1\right)}=\lambda C^{\left(2\right)}$ for some integer $\lambda$. Without this rejection, an adversary could submit $C^{\left(2\right)}=\lambda C^{\left(1\right)}$ and obtain a collision with probability roughly $1/{\lambda }^2$: the reduction $c_p^{\left(1\right)}mod{S}_1$ is uniform in $[0,S_1-1]$, so the probability that $\lambda (c_p^{\left(1\right)}mod{S}_1)<S_1$ is $1/\lambda$, and similarly for $c_q^{\left(1\right)}mod{S}_2$. For small $\lambda$ this is non-negligible. The Class 3 rejection closes this channel.

Class 4 (challenge-component reuse): any query whose first or second component equals, or is an integer scalar multiple of, the corresponding challenge component.

Class 5 (non-unit components): reject any query $C=(c_p,c_q)$ for which $gcd(c_p,S_1)\ne 1$ or $gcd(c_q,S_2)\ne 1$. This class excludes the degenerate case $c_p\equiv 0(mod{S}_1)$ (or symmetrically), in which the intermediate value a (resp. b) is identically zero and decryption produces a deterministic collision. The predicate $gcd(c_p,S_1)\ne 1$ is secret-dependent — it cannot be evaluated without $S_1$ — and constructing a ciphertext that satisfies it with non-negligible probability appears to require recovery of the corresponding hidden modulus.

The five classes are defined as separate rejection conditions; they need not be mutually disjoint. For example, a pair $C^{\left(2\right)}=\lambda C^{\left(1\right)}$ can simultaneously satisfy Class 3 (integer scalar multiple) and Class 4 (challenge-component reuse) when one component of $C^{\left(1\right)}$ matches the challenge, and Class 3 preserves Class 5 membership under multiplication by $\lambda$. The five conditions are enumerated separately because each admits a distinct rejection test, not because the sets are disjoint.

Corollary 1 

(Collision bound). Under Assumption 5, let $\mathcal{A}$ be a PPT adversary that outputs a pair $C^{\left(1\right)}\ne C^{\left(2\right)}$. Then

$$Pr\left[(C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}\wedge \mathrm{Dec}(\mathbf{SK},C^{\left(1\right)})=\mathrm{Dec}(\mathbf{SK},C^{\left(2\right)})\right]\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right),$$

except in the excluded honest-double-encryption case.

Proof. 

Immediate from Assumption 5 and Lemma 3.    □

Formal justification for the game-level restriction. The standard IND-CCA2 game prohibits the adversary from submitting the complete challenge ciphertext $C^{*}$, but not from submitting a ciphertext sharing one component with $C^{*}$, nor from submitting an integer scalar multiple. We enforce a strictly stronger restriction. Let $\mathcal{A}$ be an adversary in the restricted game, and construct ${\mathcal{A}}^{\prime }$ in the standard game that simulates $\mathcal{A}$’s queries. When $\mathcal{A}$ queries a ciphertext $C^{\prime }=(C^{\prime \left(1\right)},C^{\prime \left(2\right)})$ with $C^{\prime \left(1\right)}=C^{\left(1\right)*}$, ${\mathcal{A}}^{\prime }$ already knows $C^{\left(1\right)*}$, whose decryption under $\mathbf{SK}$ is $x^{*}$. The only information extractable from the oracle’s response is whether $C^{\prime \left(2\right)}$ decrypts to $x^{*}$, a candidate-testing query whose success probability over random $x^{*}\in {\mathbb{F}}_p$ is at most $1/p$ per query. The same argument covers integer scalar multiples $\lambda C^{\left(1\right)*}$ and Class 5 rejections: the Class 5 predicate is secret-dependent, and the adversary cannot construct a query satisfying it with non-negligible probability without recovering the hidden modulus. Hence the Class 3, Class 4, and Class 5 restrictions only remove redundant degrees of freedom; they do not improperly constrain the adversary.

4.9. IND-CCA2 Security of the Double-Encryption KEM

The double-encryption KEM of Section 3.4 achieves IND-CCA2 security in the random oracle model, under Assumptions 1, 3, 4, and 5. Assumption 2 (standalone D-HMPP) is used only in the cryptanalysis of Section 4.5 and does not appear directly in the CCA bound. The decryption-safety property required by the proof is the adaptive pairwise decryption-collision property of Lemma 3. An adversary can break IND-CCA2 by either:

• Path A (ephemeral secret). Recovering the ephemeral secret $x^{*}$ directly from $(C^{\left(1\right)*},C^{\left(2\right)*})$ via ${\mathrm{MRP}}_2$.
• Path B (long-term key). Recovering the secret key $\mathbf{SK}$ via HMPP followed by the polynomial-time Stage 2 attack, then decrypting $(C^{\left(1\right)*},C^{\left(2\right)*})$ to obtain $x^{*}$.

The proof is in the random oracle model (ROM): the hash function H is treated as a random function that the adversary may query at most $q_H$ times. The shared secret $K=H(x\parallel C^{\left(1\right)}\parallel C^{\left(2\right)})$ binds the key to the exact ciphertext and the ephemeral secret. The proof requires that, if the adversary has not queried H on $(x^{*}\parallel C^{*})$, the value K appears uniformly random.

Theorem 3 

(IND-CCA2 security, conditional on Assumptions 1, 3, 4, and 5). Assume the following four assumptions hold: Assumption 1 (HMPP), Assumption 3 (Structured D-HMPP), Assumption 4 (MRP, both ${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$), and Assumption 5 (pairwise decryption-collision resistance). Let $\mathcal{A}$ be a PPT adversary against ${\mathrm{Game}}_{\mathrm{IND}-\mathrm{CCA}2}$ (Definition 4) making at most $q_D$ decapsulation queries and $q_H$ random-oracle queries. Then there exist PPT adversaries ${\mathcal{B}}_1,{\mathcal{B}}_2,{\mathcal{B}}_3,{\mathcal{B}}_4$ such that

$$\begin{array}{cc}\hfill {\mathrm{Adv}}_{\mathrm{KEM},\mathcal{A}}^{\mathrm{ind}-\mathrm{cca}2}\left(\lambda \right)& =\left|Pr[\widehat{b}=b]-\frac{1}{2}\right|\hfill \\ \hfill & \le \underset{\mathrm{Path}\mathrm{A}\text{:}{\mathrm{MRP}}_2}{\underbrace{{\mathrm{Adv}}_{{\mathcal{B}}_1}^{{\mathrm{mr}}_2}\left(\lambda \right)}}+\underset{\mathrm{Path}\mathrm{B}\text{:}\mathrm{HMPP}}{\underbrace{{\mathrm{Adv}}_{{\mathcal{B}}_2}^{\mathrm{hmpp}}\left(\lambda \right)}}\hfill \\ \hfill & +\underset{\mathrm{fixed}-\mathrm{pair}\mathrm{collision}}{\underbrace{{\mathrm{Adv}}_{{\mathcal{B}}_3}^{\mathrm{collision}}\left(\lambda \right)}}+\underset{\mathrm{adaptive}\mathrm{reduction}}{\underbrace{{\mathrm{Adv}}_{{\mathcal{B}}_4}^{\mathrm{structured}-\mathrm{dhmpp}}\left(\lambda \right)}}\hfill \\ \hfill & +{\displaystyle \frac{(q_D+q_H)}{p}}+\mathrm{negl}\left(\lambda \right).\hfill \end{array}$$

Under the four assumptions above, every term on the right-hand side is negligible in λ: the two attack-path advantages by Assumptions 4 and 1, the fixed-pair collision term by Assumption 5, and the adaptive-reduction term by Assumption 3. The trailing $\mathrm{negl}\left(\lambda \right)$ absorbs the random-oracle simulation loss and the polynomial slack from the per-query bounds. Assumption 2 (standalone D-HMPP) supports the cryptanalysis of Section 4.5 but does not appear directly in the bound.

Proof. 

Let $E_i$ denote the event that $\mathcal{A}$ wins in Game i.

Game 0 (real game). This is ${\mathrm{Game}}_{\mathrm{IND}-\mathrm{CCA}2}$, so ${\mathrm{Adv}}_{\mathrm{KEM},\mathcal{A}}^{\mathrm{ind}-\mathrm{cca}2}\left(\lambda \right)=|Pr\left[E_0\right]-1/2|$.

Game 1 (explicit rejection). Modify $\mathrm{Decaps}$ to reject Classes 1–5 explicitly. Classes 1 and 3 are testable from the ciphertext alone; Classes 2 and 5 are evaluated using the hidden moduli before the main decryption computation; Class 4 is enforced by the game. By Lemma 3, the adaptive form of the fixed-pair collision bound, the remaining admissible queries satisfy

$$Pr\left[(C^{\left(1\right)},C^{\left(2\right)})\notin \mathcal{R}\wedge \mathrm{Dec}\left(C^{\left(1\right)}\right)=\mathrm{Dec}\left(C^{\left(2\right)}\right)\right]\le {\displaystyle \frac{1}{p}}+\mathrm{negl}\left(\lambda \right)$$

per query. The two losses that appear in Lemma 3 are the fixed-pair collision bound of Assumption 5 and the Structured D-HMPP hybrid that reduces the adaptive case to the fixed-pair case. Over $q_D$ queries,

$$|Pr\left[E_0\right]-Pr\left[E_1\right]|\le {\mathrm{Adv}}_{{\mathcal{B}}_3}^{\mathrm{collision}}+{\mathrm{Adv}}_{{\mathcal{B}}_4}^{\mathrm{structured}-\mathrm{dhmpp}}+{\displaystyle \frac{q_D}{p}}+q_D·\mathrm{negl}\left(\lambda \right).$$

Game 2 (random challenge key). Replace $K_0$ by a uniform $K_{\mathrm{rand}}$ independent of b; then $Pr\left[E_2\right]=1/2$. A transition between Games 1 and 2 requires $\mathcal{A}$ to query H on $(x^{*}\parallel C^{*})$. Three disjoint events cover this: Path A (recover $x^{*}$ via ${\mathrm{MRP}}_2$) contributes ${\mathrm{Adv}}_{{\mathcal{B}}_1}^{{\mathrm{mr}}_2}$; Path B (recover $\mathbf{SK}$ via HMPP plus Stage 2) contributes ${\mathrm{Adv}}_{{\mathcal{B}}_2}^{\mathrm{hmpp}}$; and guessing $x^{*}$ directly contributes at most $q_H/p$. Hence

$$|Pr\left[E_1\right]-Pr\left[E_2\right]|\le {\mathrm{Adv}}_{{\mathcal{B}}_1}^{{\mathrm{mr}}_2}+{\mathrm{Adv}}_{{\mathcal{B}}_2}^{\mathrm{hmpp}}+{\displaystyle \frac{q_H}{p}}.$$

Combining. By the triangle inequality, and using $Pr\left[E_2\right]=1/2$,

$$|Pr\left[E_0\right]-\frac{1}{2}|\le |Pr\left[E_0\right]-Pr\left[E_1\right]|+|Pr\left[E_1\right]-Pr\left[E_2\right]|.$$

Substituting the two bounds above and folding the $q_D·\mathrm{negl}\left(\lambda \right)$ slack and the random-oracle simulation loss into the trailing $\mathrm{negl}\left(\lambda \right)$ yields the stated result.    □

Proof notes. The random oracle H is simulated by maintaining a shared table of queried values $(x\parallel C)\mapsto H(x\parallel C)$, and decapsulation queries are answered consistently with this table. Classes 1, 2, 3, and 5 are enforced by the decapsulation algorithm; Class 4 is enforced by the IND-CCA2 game. The simulation argument in Section 4.8 shows that the game-level restriction for Class 4 is without loss of generality up to $q_D/p$. The enlarged rejection set is what makes the joint form of Assumption 5 applicable to every remaining oracle query, so that the collision contribution is bounded by $q_D/p$ rather than by a larger quantity. The proof is in the classical random oracle model; QROM security is left for future work.

4.10. Concrete Security Levels

Classical security level. Both attack paths are exhaustive searches over spaces of size $2^l$: long-term key recovery via HMPP and ephemeral-secret recovery via ${\mathrm{MRP}}_2$. The parameter set is assigned an l-bit search-based security level under the convention of Section 1.2, analogous to AES key search: $l=128$ corresponds to Level I, $l=192$ to Level III, and $l=256$ to Level V. This is a definitional assignment from the search-space size and verification cost, not a computational lower bound. The polynomial factors $L^2$ (MRP) and $poly\left(L\right)$ (HMPP) are not counted in the security level.

Generic quantum cost of the best-known search attacks. The best-known attacks on HMPP and MRP both contain an unstructured search step, and Grover’s algorithm applied to that step reduces the number of iterations to approximately $2^{l/2}$. This is a generic Grover cost on the search step alone. It does not account for the quantum cost of implementing the verification oracle (lattice reduction for HMPP, modular linear-system solving for MRP), nor for circuit depth, width, or memory. We therefore do not claim an established quantum security level; the numbers below are best read as the Grover-scaled cost of the classical search step. We emphasize that $l/2$, not l, is the binding exponent in this Grover-scaled estimate. A full quantum resource estimation is left for future work.

Assumption dependencies. Key recovery depends on Assumption 1 (Theorem 2); message recovery is defined by MRP (Assumption 4); the pairwise collision-resistance property is Assumption 5, with its adaptive form reduced through Structured D-HMPP (Lemma 3); IND-CCA2 depends on four of the five assumptions (Theorem 3), with standalone D-HMPP (Assumption 2) supporting the cryptanalysis.

4.11. Security Summary

D-HPPK rests on five assumptions: HMPP, D-HMPP, Structured D-HMPP, MRP (in both ${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$ forms), and pairwise decryption-collision resistance. Key recovery costs $O(2^l·poly\left(L\right))$ under HMPP; message recovery is defined by MRP; marginal uniformity of the decryption output is proved from the hidden-ring modular reduction; the pairwise collision property is assumed, with its adaptive form reduced through Structured D-HMPP; and IND-CCA2 security follows from a union bound over both attack paths in the classical random oracle model, conditional on four of the five assumptions. The five-class rejection set ensures the collision bound applies to every remaining oracle query. The security level is l bits under the search-based convention, determined by the size $|{\mathbb{F}}_p|=2^l$ of the search space and the $O\left(L^2\right)$-time verification.

4.12. Open Problems

The security claim of D-HPPK is conditional on five assumptions, four of which are hardness statements about the underlying problems: HMPP, D-HMPP, Structured D-HMPP, and MRP. None of these is proved, and the security proof is conditional on all of them holding. The construction itself does not depend on their resolution: the scheme is well-defined and the correctness proof stands independently. But the assigned security level is meaningful only if the assumptions are, and the two most consequential open questions are therefore the hardness of the two problems on which the two attack paths depend.

1.

Is HMPP hard? A polynomial-time classical or quantum algorithm that recovers $(S,R)$ from the public samples $A_i\equiv R{\tilde{a}}_i(modS)$ would break long-term key recovery and hence the scheme. HMPP is related in structure to the Approximate Common Divisor problem, and the strongest known attack family in that setting is the full-sample lattice technique [35,36]; whether it transfers to HMPP, and with what complexity, is open. A reduction of HMPP to a well-studied lattice problem would provide an independent foundation for the assigned security level; a polynomial-time algorithm would invalidate it.

2.

Is MRP hard? A polynomial-time classical or quantum algorithm that recovers the ephemeral secret $x^{*}$ from $(\mathbf{PK},C^{*})$ would break ephemeral-secret recovery and hence the scheme. MRP is a scheme-induced search problem whose instances are modular polynomial systems with the coefficient distribution of D-HPPK; the best-known attack is exhaustive search over ${\mathbb{F}}_p$ with an integer verification per candidate. Whether the algebraic structure of the resulting MMPS family admits an algorithm that reduces the search space below $2^l$ is open. The question applies to both forms of MRP (${\mathrm{MRP}}_1$ and ${\mathrm{MRP}}_2$).

The cryptanalysis in Section 4.5 and Section 4.6 constitutes the current evidence base for the hardness of HMPP and MRP respectively. We invite independent cryptanalysis and ask to be notified of any findings so that the security claims can be updated.

5. Implementation and Performance

This section reports the performance of the D-HPPK reference implementation on a single platform. Sizes and operation counts, which are implementation-independent, are also reported.

5.1. Parameter Selection

We fix $n=2$ and $m=3$; these choices ensure unique decryption, minimize the public key size, and enable efficient finite-field evaluation. The hidden moduli satisfy $S_1,S_2>9p^2$. Both key recovery and ephemeral-secret recovery have best-known classical cost $O(2^l·poly\left(L\right))$, where $l=\lceil {log}_{2}p\rceil$ and $L=2l+8$. The resulting key and ciphertext sizes are summarized in Table 3.

The shared secret is derived as $K=H(x\Vert C^{\left(1\right)}\Vert C^{\left(2\right)})$, where H outputs 256 bits.

Parameter selection uses the best currently analyzed HMPP attack cost $O(2^l·poly\left(L\right))$, conditional on the ACD-template heuristic, with the elementary GCD fallback at $O(2^{2l}·poly\left(L\right))$ providing additional margin.

The choice of $m=3$. The parameter m is the number of noise variables in $B(x,\mathbf{u})$ and determines the kernel dimension of $\delta$ as $m-1$. At $m=3$, the kernel is two-dimensional and the MMPS system is uniquely solvable for each x. Increasing m grows the public key linearly in m and the per-candidate verification cost as $O\left(m^3\right)$, while the best-known attack on MRP remains $2^l$. We therefore adopt $m=3$ as the minimal choice.

5.2. Reference Implementation and Platform

We implemented a reference implementation of the D-HPPK IND-CCA2 KEM in C using GMP for large integer arithmetic and OpenSSL for SHA-256. The reference implementation performs the double encryption of Section 3.4, the consistency check, and the rejection handling for Classes 1 and 2 of Section 4.8. All measurements were obtained on a single platform: 12th Generation Intel Core i5-1240P (1.70 GHz base, 4.40 GHz turbo), Windows 11 64-bit, 16 GB RAM, GCC with -O2 -march=native. Measurements are averages over 10,000 iterations after a 1,000-iteration warm-up; standard deviations across iterations were below 5% of the mean. The implementation has not been subjected to architecture-specific optimizations. It is an academic illustration of the construction, not a production-grade or constant-time implementation and not intended as a performance benchmark; see Section 5.4.

5.3. Operation Counts and Cycle Counts

The computational cost of D-HPPK is dominated by modular arithmetic in ${\mathbb{F}}_p$ and multiplication of L-bit integers. Table 4 summarizes the operation counts for the unified parameter set $(n=2,m=3)$.

Table 5 reports the measured cycle counts, in k-cycles. Figure 4 plots the same data.

At $l=256$, the reference implementation takes approximately 9,300 cycles for encapsulation and 18,000 cycles for decapsulation, corresponding to roughly $5.5\mu \mathrm{s}$ and $10.6\mu \mathrm{s}$ at 1.7 GHz. Scaling across security levels is roughly linear in l.

Scaling. The algorithmic structure of D-HPPK is identical across security levels; only l and $L=2l+8$ change. Total cost scales as $O\left(l^3\right)$ under schoolbook multi-precision arithmetic and $O\left(l^{2+ϵ}\right)$ with subquadratic multiplication. At very large l ($l>1024$), the $O\left(l^2\right)$ multiplication becomes the dominant bottleneck. For $l\in [128,512]$, this is not a constraint.

5.4. Implementation Status and Constant-Time Roadmap

The current implementation is a prototype for correctness and performance indication. It uses GMP for large integer arithmetic and is not constant-time. We document below the specific operations that would require hardening in a constant-time reference implementation, together with the standard techniques that would be used.

Decapsulation (security-critical path). The six operations that involve secret values are: (i) reduction of $c_p,c_q$ modulo $S_1,S_2$ (Barrett or Montgomery); (ii) multiplication by $R_1^{-1},R_2^{-1}$ (fully unrolled routine with no early termination); (iii) modular inversion of b in ${\mathbb{F}}_p$ (fixed-window exponentiation $b^{p-2}$); (iv) the division for $x={\mathsf{\Phi }}^{-1}\left(k\right)$; (v) the consistency check $x_1=x_2$ (branch-free selector via ${(x_1-x_2)}^{p-1}$); and (vi) the five-class rejection comparisons, including the Class 3 divisibility check and the Class 5 constant-time gcd of $c_p$ with $S_1$ and $c_q$ with $S_2$.

Key generation. Rejection sampling of $S_1,S_2$; sampling of $R_1,R_2$ with fixed-time coprimality testing; modular inversion of $R_1,R_2$; and the computation of ${\widehat{P}}_{ij},{\widehat{Q}}_{ij}$ with constant-time modular multiplication.

Encapsulation. In the standard KEM threat model, encapsulation is executed by the sender on a trusted machine. If the sender’s platform is compromised, the shared secret could leak through timing, but this is outside the standard IND-CCA2 model.

The techniques listed are standard and have been implemented in production libraries such as BearSSL, BoringSSL, and libsodium. The work required for D-HPPK is engineering rather than research: adapting known constant-time primitives to the specific multi-precision bit-lengths used here ($L=2l+8$ bits). We leave this implementation work for a subsequent revision, and we state clearly that the current prototype should not be deployed as-is.

Implementation-level attacks (timing, cache, fault injection, power analysis) are outside the scope of this work.

6. Conclusions

We have introduced D-HPPK, the Defactorized Homomorphic Polynomial Public Key key encapsulation mechanism, a post-quantum cryptosystem whose security rests on five hardness assumptions: HMPP, its decisional form D-HMPP, Structured D-HMPP, the scheme-induced MRP in its single- and double-ciphertext forms, and a scheme-induced pairwise decryption-collision resistance assumption. The scheme combines a three-layer architecture of additive random masking and hidden-ring embeddings: the hidden rings prevent the public-constraint attack, and the random masking destroys the rank-2 algebraic regularity that the original HPPK construction exposed.

D-HPPK is a search-based cryptosystem in the sense of AES: its security level is assigned from the size of the search space and the efficiency of verification, following the NIST convention. Both key recovery and ephemeral-secret recovery have best-known classical cost $O(2^l·poly\left(L\right))$, and the IND-CCA2 proof rests on a union bound over both paths, conditional on four of the five assumptions. The consistency check relies on the pairwise decryption-collision assumption, whose adaptive form is reduced through Structured D-HMPP; the marginal uniformity of the decryption output is proved from the hidden-ring modular reduction. At Level V, D-HPPK achieves a 1234-byte public key and a 392-byte CCA2 ciphertext, more compact than lattice-based KEMs at comparable security levels, with a single implementation scaling across security levels without SIMD or NTT.

The IND-CCA2 proof is not established in the quantum random oracle model, and further cryptanalysis of HMPP, MRP, and the pairwise collision assumption is invited. Directions for future research: further cryptanalysis of the two hardness problems; a proof of the two-dimensional equidistribution lemma or a reduction of Structured D-HMPP to the standalone form, either of which would reduce the assumption count; a constant-time implementation; a quantum random-oracle proof; and adaptation of the conjugated masking architecture to other primitives.

D-HPPK establishes that polynomial-based cryptography can simultaneously deliver compact representations and a simple algorithmic structure, offering a transparent alternative to lattice- and code-based post-quantum KEMs.