## 2 Preliminary Background
### Hybrid Cryptosystem  
A key establishment protocol aims to allow two participants who have their own source of randomness and need to establish a common secret. The output shared secret must be the same value for the two participants, and it has to be unknown to any outsider. The proposed key establishment protocol is designed based on a hybrid cryptosystem, which was formalized by [PERSON] and [PERSON] [17]. The hybrid construction paradigm, also known as the KEM-DEM construction, consists of two lower-level building blocks: a key encapsulation mechanism (KEM) and a data encapsulation mechanism (DEM). Generally, a KEM is a method by which two participants exchange their random contributions to the generation of the shared secret in a protected manner. Specifically, a KEM takes a private and public key pair to generate a random symmetric key and its encapsulation for the handshake. Meanwhile, a DEM properly encrypts a message payload using the generated symmetric key (the shared secret) with a symmetric block cipher. Fundamentally, a KEM consists of three operations:  
* A key generation operation \(KEM.KeyGen\) that outputs a public and private key pair. The generation of a key pair depends on the chosen underlying algorithm.
* An encapsulation operation \(KEM.Encrypt\) that takes a key pair of the sender, and a public key of the receiver, and outputs a shared key \(K\) and an encapsulated text \(C1\).
* A decapsulation operation \(KEM.Decrypt\) that takes a key pair of the receiver, a public key of the sender, and an encapsulated text \(C1\), and extracts the shared key \(K\) if the operation is valid.  
A data encapsulation mechanism (DEM) is either an encryption or a decryption operation of a chosen block cipher. Figure 1 describes the model of a KEM and DEM in a hybrid cryptosystem.  
This hybrid paradigm takes advantage of the speed and efficiency of symmetric cryptography in the encryption and decryption of an arbitrary length payload. Moreover, the hybrid model relies on highly secure public key cryptography to generate a unique symmetric key for communication. This modular design approach also has a primary benefit in that the security requirements of the asymmetric and symmetric parts of the scheme can be completely independent of each other. Thus, it allows for freedom in the  
Figure 1: Hybrid KEM-DEM paradigm.  
selection of the underlying algorithms for each part to construct a protocol that suits a specific application [18; 19]. An example of a cryptosystem based on the Diffie-Hellman (DH) method that applies an AES cipher block as the data encapsulation can be found in [20]'s specification. Note that these selections for a hybrid cryptosystem offer security to an extent under a particular security assumption; thus, it is still vulnerable to some attacks, such as key compromise impersonation attacks. This research aimed to utilize the modular characteristic of this hybrid model to construct a key establishment protocol. The proposed protocol applies a modified version of a KEM with signcryption cryptography. Also, the ECQV implicit signcryption scheme is used as the _KEM.KeyGen_ operation to reduce the cost of public key cryptography as opposed to a DH-based KEM in the specification [20].