Cryptographers Build Hybrid Key Encapsulation to Bridge Classical and Post-Quantum Encryption

The rapid progress of quantum computing threatens widely deployed public-key cryptosystems such as RSA and Diffie–Hellman, because Shor’s algorithm can break the mathematical problems on which both rely. That threat has accelerated a global migration toward post-quantum cryptography, and during this transition standardization bodies and cybersecurity agencies strongly recommend hybrid key encapsulation mechanisms, or KEMs, that combine classical and post-quantum primitives. A new study published in the open-access journal Cybersecurity addresses a gap in how such hybrids are built: while existing designs mostly pair post-quantum KEMs with Diffie–Hellman-style key agreement, the systematic integration of standardized classical public-key encryption schemes with post-quantum KEMs has remained largely unexplored.

A key encapsulation mechanism is a fundamental cryptographic primitive for establishing shared secrets between two parties. Hybrid designs matter because post-quantum schemes are relatively new and may still lack extensive cryptanalysis and mature implementations, whereas classical public-key primitives have been studied for decades and can serve as a conservative hedge against potential weaknesses in emerging post-quantum constructions. The overall scheme remains secure even if one of the underlying components is compromised. Prior hybrid constructions, including X-Wing, derive the combined key from a classical Diffie–Hellman shared secret and a post-quantum KEM key, sometimes trimming redundant inputs to pseudorandom function computations by relying on a property called ciphertext second-preimage resistance, abbreviated C2PRI.

The new work, authored by Biming Zhou, Yukai Zhang, Haodong Jiang and Yunlei Zhao, introduces two generic hybrid constructions, HybKEM and HybKEM*, that combine a classical public-key encryption scheme with a post-quantum KEM satisfying C2PRI. C2PRI, introduced by Barbosa and colleagues, means that even an adversary holding the secret decapsulation key cannot find a distinct ciphertext that decapsulates to the same session key for a given ciphertext. The authors note this property may hold even for KEMs that are not IND-CCA secure, and that KEMs obtained from a certain class of Fujisaki–Okamoto transformations satisfy it in both the random oracle model and the quantum random oracle model, including schemes such as ML-KEM, (e)FrodoKEM, HQC, Classic McEliece and various NTRU variants.

The basic construction, HybKEM, derives the shared key from the full classical PKE ciphertext, computing a hash of the public-key identifier, the post-quantum encapsulated key, the decrypted PKE message and the complete ciphertext. The refined construction, HybKEM*, goes further: it derives the shared key from only a designated component of the PKE ciphertext. To make this possible, the authors introduce a new security notion for public-key encryption, termed partial ciphertext second-preimage resistance, or PC2PRI. This notion extends C2PRI to the encryption setting and captures second-preimage resistance when a designated ciphertext component is fixed, formalized through a public partition function that splits each ciphertext into a fixed part and a free part.

The security guarantees are stated precisely. HybKEM achieves post-quantum IND-CCA security assuming the post-quantum KEM is IND-CCA secure and the hash function is a secure pseudorandom function, and it achieves classical IND-CCA security if the classical PKE is IND-CCA secure, the KEM satisfies C2PRI, and the hash is a secure PRF. HybKEM* achieves post-quantum IND-CCA security if, in addition, the PKE satisfies the PC2PRI property with respect to the chosen projection. All four formal analyses, presented as Theorems 1 through 4 with explicit advantage bounds, are carried out in the standard model, although the authors emphasize in a remark that the concrete component properties, C2PRI for the KEM and PC2PRI for the PKE, are formally analyzed in the random oracle and quantum random oracle models, so concrete instantiations are established in the ROM/QROM setting.

To demonstrate that the new notion is practically relevant, the authors systematically analyze PC2PRI for several standardized classical encryption schemes: ECIES, specified in ANSI X9.63, IEEE 1363a and ISO/IEC 18033-2; PSEC, specified in ISO/IEC 18033-2; and SM2, specified in the Chinese cryptographic standard GM/T 0003.4. All three follow a hybrid Diffie–Hellman encryption paradigm and, notably, achieve perfect correctness. For ECIES, whose ciphertexts take the form (R, C, t), the authors examine two partition functions, one fixing the authentication tag t and one fixing the pair (R, C).

The results for ECIES are quantitative. Under the partition fixing the tag, ECIES satisfies t-PC2PRI provided the underlying message authentication code is MacColl-secure and the key-derivation function is modeled as a quantum-accessible random oracle; the adversary’s advantage is bounded by twice the MAC collusion advantage plus a collision term of (q+1) cubed over two to the power of the MAC key length, where q counts quantum random-oracle queries. Under the partition fixing (R, C), the result is stronger: assuming only a deterministic MAC algorithm, the advantage of any quantum-polynomial-time adversary is exactly zero, because a deterministic MAC forces any valid alternative tag to equal the original one. PSEC satisfies t-PC2PRI under analogous assumptions with a similar bound, and SM2 satisfies C1-PC2PRI with adversary advantage exactly zero, since fixing the ciphertext component C1 uniquely determines the Diffie–Hellman shared point and hence every remaining ciphertext component.

The paper also situates itself against closely related work. In independent and concurrent research, the authors of StarHunters proposed a general framework for constructing hybrid KEMs from a classical PKE scheme and a post-quantum KEM satisfying C2PRI, using a two-layer paradigm that first converts an IND-CCA-secure PKE into a KEM and then composes two component KEMs. The authors state that their basic construction HybKEM is close in spirit to StarHunters, while their work differs in directly formulating hybrid constructions from a classical PKE and a C2PRI post-quantum KEM, introducing and formalizing the PC2PRI property, supporting the refined construction HybKEM* with key derivation from a designated ciphertext component, and systematically analyzing PC2PRI for standardized schemes.

The broader significance lies in widening the toolbox available during the post-quantum migration. By showing that established, standardized encryption schemes such as ECIES, PSEC and SM2 can serve as the classical component of a provably secure hybrid KEM, the framework offers deployers a route to combine long-studied classical primitives with newer post-quantum ones without routing everything through Diffie–Hellman key agreement. The authors conclude by presenting this as the first systematic framework for hybrid KEM constructions combining classical PKEs with post-quantum KEMs, and they suggest future directions including the exploration of additional PKE standards that satisfy PC2PRI and the study of more concise hybrid constructions. They also note that while PC2PRI is tailored to their constructions, it may find broader applications in other PKE-based protocols.

As with any cryptographic proof, the guarantees are conditional on the stated assumptions: perfect correctness and IND-CCA security of the classical component, C2PRI or PC2PRI of the relevant components, and pseudorandom-function security of the key-derivation hash, with concrete instantiations resting on random-oracle modeling. No new deployment recommendations accompany the theory, and no datasets were generated or analyzed in the study. What the work delivers is a formal bridge, proven in the standard model at the composition level, between the encryption schemes already standardized in international and Chinese cryptographic practice and the post-quantum KEMs now entering global use, at a moment when agencies responsible for critical infrastructure are actively planning a careful, hedge-preserving transition to quantum-resistant cryptography.

Subject of Research: Hybrid key encapsulation mechanisms combining classical public-key encryption with post-quantum KEMs

Article Title: Hybrid KEM constructions from classical PKEs and post-quantum KEMs

Article References: Zhou, B., Zhang, Y., Jiang, H., & Zhao, Y. (2026). Hybrid KEM constructions from classical PKEs and post-quantum KEMs. Cybersecurity, 9(1), Article 247. https://doi.org/10.1186/s42400-026-00624-0

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00624-0

Keywords: post-quantum cryptography, key encapsulation mechanism, hybrid KEM, IND-CCA security, ECIES, PSEC, SM2, ciphertext second-preimage resistance, PC2PRI, public-key encryption, quantum computing, cryptographic standards