Non-Interactive Key Exchange from Lattices in the Standard Model

Existing non-interactive key exchange (NIKE) constructions in the CKS-heavy security model either incur loose security reductions or lack lattice instantiations due to the absence of suitable hash proof systems (HPS). To overcome this limitation, we introduce a new cryptographic primitive, named as decoupled key encapsulation mechanisms (decoupled KEMs), which separates recipient-independent ciphertext generation from recipient-specific key derivation. Moreover, we formalize the security of our decoupled KEM as MU-IND-wCCA^Corr+, which is a multi-user security notion. Based on this, we give a new framework that any decoupled KEM with MU-IND-wCCA^Corr+ implies a NIKE protocol with much tighter security in the CKS-heavy security model. For concrete instantiation, we first construct a specific HPS based on Modulus-LWE in the standard model, and then obtain a decoupled KEM with the desired security notion. Applying our framework, we obtain a lattice-based NIKE secure in the standard model, denoted NIKE HPS . NIKE HPS . achieves a linear security reduction loss in the number of users and close to the known optimum, improving upon the quadratic loss of SWOOSH (USENIX Security' 24) under CKS-heavy security. Experiments show that our protocol achieves significant speedups in key generation and shared-key derivation over SWOOSH.