Post-Quantum Security

Platus implements hybrid encryption protocol BJJ-KEM1024, combining classical ECDH over Baby Jubjub with ML-KEM-1024 (FIPS 203) to provide post-quantum security for note encryption.

Hybrid Key Construction

Public Keys

The hybrid public key combines two components:

$$hPK = (ic, mPK)$$

• ECC public key: $ic = [vk]G$
• ML-KEM public key: $mPK \text{ (1568 bytes, FIPS 203)}$

Both are derived from the same spending public key via deterministic key derivation.

Private Keys

$$hSK = (vk, mSK)$$

• ML-KEM secret key: $mSK \text{ (3168 bytes)}$

Encryption Protocol

1. Generate ephemeral ECDH keypair:

   $$r \leftarrow \mathbb{F}_r$$ $$R = [r]G$$

2. Compute ECDH shared secret:

   $$S_{ecdh} = [r] ic$$

3. ML-KEM encapsulation:

   $$(S_\text{mlkem}, ct_\text{mlkem}) = \text{ML-KEM-1024.Encapsulate}(mPK)$$

• Returns 32-byte shared secret $S_\text{mlkem}$ and 1568-byte ciphertext $ct_\text{mlkem}$.

5. Derive nonce:

   $$nonce\_ikm = S_{ecdh} \,\|\, S_\text{mlkem}$$ $$nonce = \text{HKDF-Expand}(\text{HKDF-Extract}(nonce\_ikm), 12)$$

6. Authenticated encryption:

   $$plaintext = r \,\|\, m$$ $$ct_{aead} = \text{ChaCha20-Poly1305.Encrypt}(key, nonce, plaintext)$$

7. Output:

   $$ciphertext = ct_{mlkem} \,\|\, ct_{aead}$$ $$encapsulated\_secret = R$$

• Sizes:
  • $ct_{mlkem}$: 1568 bytes
  • $ct_{aead}$: $\text{len}(m) + 32 + 16$ (message + ephemeral scalar + auth tag)
  • $R$: 64 bytes

Decryption Protocol

Inputs

• Ciphertext ($ct_{mlkem}$, $ct_{aead}$)
• Encapsulated secret point ( R )
• Receiver hybrid private key (${vk}$, ${mSK}$)

Process

1. Parse ciphertext

   $$ct_{mlkem} = ciphertext[0:1568]$$ $$ct_{aead} = ciphertext[1568:]$$

2. Validate encapsulated secret

   $$R' = \text{BabyJubJub.fromBytesUnsafe}(R)$$

3. Compute ECDH shared secret

   $$S_{ecdh} = [{vk}]R'$$

4. ML-KEM decapsulation

$$S_{mlkem} = \begin{cases} \text{ML-KEM-1024.Decapsulate}(ct_{mlkem}, {mSK}), & \text{if valid} \\ 0^{32}, & \text{if decapsulation fails} \end{cases}$$

5. Derive decryption key (same as encryption)

$$ikm = R \,\|\, S_{ecdh} \,\|\, S_{mlkem}$$ $$prk = \text{HKDF-Extract}(ikm)$$ $$key = \text{HKDF-Expand}(prk, 32)$$

6. Derive nonce and decrypt

$$nonce\_ikm = S_{ecdh} \,\|\, S_{mlkem}$$ $$nonce = \text{HKDF-Expand}(\text{HKDF-Extract}(nonce\_ikm), 12)$$ $$plaintext = \text{ChaCha20-Poly1305.Decrypt}(key, nonce, ct_{aead})$$

7. Verify ephemeral secret

$$r \,\|\, m = plaintext$$ $$R_{check} = [r]G$$ $$\text{result} = \begin{cases} m, & \text{if } R_{\text{check}} = R' \\ \text{null}, & \text{otherwise (invalid)} \end{cases}$$

Threat Model

• Classical adversary: Cannot break discrete log on Baby Jubjub.
• Quantum adversary: Can break elliptic curve discrete log (Shor's algorithm) but cannot break lattice-based cryptography (ML-KEM).
• Hybrid security: Notes remain secure if either ECDH or ML-KEM is unbroken. Both must fail for confidentiality to be compromised.