Report on Present State ofPSEC-KEM Cryptosystem
Evaluation(screening evaluation)
January 28, 2002
Natsume Matsuzaki, Member
Public-Key Cryptography
Subcommittee
1

PSEC-KEM cryptosystem(submitter’s claims)• Category:Key agreement – Proposes key generations, E, and D in the illustration.
• Provable security: Provides the strongest security based on random oracle model.
(a) IND-CCA2 security definition for key encapsulation mechanism(by Dr.Shoup)(b) Proof that the scheme is reduced to EC-CDH under random oracle model.
• SW implementation:Key generation: 5.64ms, encryption: 11.09ms, decryption: 10.97ms(Pentium III 600MHz)
Ciphertext C
Public key pk

E

Shared keyk

Secret key sk

D

Shared keyk

2

Evaluation methods• PSEC-KEM:- Submitted as a modification of PSEC-2 (cryptosystem submittedto CRYPTREC2000).
- Based on a study by this Subcommittee, a decision was made toevaluate the cryptosystem as a new submission.
• In addition to a screening evaluation, the relationship between
this cryptosystem and PSEC-2 was also evaluated for reference
purposes.

3Screening evaluation
While no major problems were discovered, the following issues were observed.
<Category>
The cryptographic technique specifications describe the scheme as a key
agreement scheme, while the self-evaluation describes it as a key
encapsulation mechanism used in a hybrid cryptosystem. Thus consistency
and associations are unclear.
<Cryptographic technique specifications>- The primitive section does not contain elliptic curve recommended
parameters.
- It is unclear what level of security is attained by the recommended
parameters in the scheme section.
<Self-evaluation>
The security definition for key encapsulation is satisfactory, and there are
no deficiencies in the security proofs. However, the claim that they have
proved that the strongest security is provided by IND-CCA2 could be
misunderstood.
4

(Reference information) Evaluation of PSEC-KEM as amodification of PSEC-2 in response to issues in PSEC-2(CRYPTREC2000 submission)
PSEC-2Category

SchemePrimitive

PSEC-KEM

Issues noted at CRYPTREC2000

Appropriateness ofcriticism

Modification

1“hLen ≤ k” is written where “hLen≅k” should be written.
(hLen: hash output bit length; k: security parameter whichis the bit length of order of the base point).

Appropriate

Omission;correction needed.

2“rLen ≤ qLen” was written where “rLen≅qLen” shouldhave been written.
(rLen：random number bit length; qLen: bit length of thesize of the definition field)

Appropriate

Change inspecifications; notapplicable

3

Typographical errors
Elliptic curve parameter values and elliptic curveconditions are missing.

Appropriate

Omission; addition
needed.

4

The exclusion of characteristic 3 field is not explicitly
stated.

Appropriate

Solved5If the first coordinate of an element on the elliptic curveis used as a mask, is there a possibility that semanticsecurity will be adversely affected?

Not reviewed

Change inspecifications; notapplicable5(Reference Information) Relationship between PSEC-KEM
and PSEC-2, and comparison with other methods¾ Relationship with PSEC-2: PSEC-KEM may be considered a separate scheme forthe following reasons.
– PSEC-2 has plaintext input, whereas PSEC-KEM does not.
– Their categories and definitions of security are different.
– They are similar in that they both use secret random number r, but PSEC-2 involves
plaintext, whereas PSEC-KEM does not.

¾ Comparison with ECIES-KEM and ACE-KEM
Compared parameters
Processing time(elliptic curveadditions)

PSEC-KEM

ACE-KEMECIES-KEM

Encryption

252

Decryption

23

1

IND-CCA2Security
Provable security

Model

Random oracle
modelStandard
model

Random oracle
model

Security
hypothesis

CDHDDH

Gap-DH6