KYBER.CPAPKE: IND-CCA Security of Lyubashevsky, Peikert, Regev (LPR) Encryption

Question

The NIST Kyber KEM spec. defines an encryption scheme, KYBER.CPAPKE, that's a variant of the so called Lyubashevsky, Peikert, Regev ("LPR") encryption scheme [1]. While LPR encryption is typically defined over subrings of cyclotomic number fields, KYBER.CPAPKE is instantiated over an $R_q$-Module where the base commutative ring is $R_q := \mathbb{Z}_q[X]/ \langle \Phi_{512}(x)\rangle$ and $q = 3329$. It seems like neither KYBER.CPAPKE nor its plain ring analogue are IND-CCA1/2 secure. Is this a true statement? (I'm assuming that its true which is the reason for the Fujisaki-Okomoto transform in the Kyber spec.)

[1] [LPR2013a] Lyubashevsky, Vadim and Peikert, Chris and Regev, Oded, "On Ideal Lattices and Learning with Errors over Rings". J. ACM, November 2013 Vol.60/6, 2013.

Answer 1

. It seems like neither KYBER.CPAPKE nor its plain ring analogue are IND-CCA1/2 secure

Yes, it's a true statement. You might have already noticed the CPA in the KYBER.CPAPKE name.

And your understanding about (the need for) FO transformation is correct.

_{Up-voting the Q for the honest learning effort!}