0
$\begingroup$

Observing the code example from pqcrypto-kyber, is the decapsulate function $d$ homomorphic?

If $d(ct, sk_i) = ss_i$, is it true that $d(ct, \sum_i sk_i) = \sum_i ss_i$ ?

$\endgroup$
1
$\begingroup$

Kyber claims to be CCA secure. CCA schemes cannot be homomorphic (thinking through this may be a useful exercise).

It may be useful to try to work through this particular example with pen and paper by looking at algorithm 5 in the Kyber paper. Note that what is returned is some hash, which you should not expect to have homomorphic properties.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.