6 ms·
Yes, Kyber (ML-KEM) ciphertexts can be compressed somewhat when you are sending the same message to multiple recipients. See https://csrc.nist.gov/csrc/media/Ev
by nmadden 2y ago
Yes, Kyber (ML-KEM) ciphertexts can be compressed somewhat when you are sending the same message to multiple recipients. See https://csrc.nist.gov/csrc/media/Events/2024/fifth-pqc-standardization-conference/documents/papers/how-multi-recipient-kems.pdf https://csrc.nist.gov/csrc/media/Events/2024/fifth-pqc-stand... for details:
> "Asymptotically, the size of an mKyber multi-recipient ciphertext is 16 times smaller than the sum of the sizes of N Kyber ciphertexts.”
There’s a whole zoo of useful variants on the “KEM” idea, but sadly NIST decided to standardise the least flexible variant. See my blog from a few years ago for some background on the literature: https://neilmadden.blog/2021/02/16/when-a-kem-is-not-enough/ https://neilmadden.blog/2021/02/16/when-a-kem-is-not-enough/