Ilmu Komputer & AI editorial
Open AccessOA2026
Dependency-Aware ROM/CBD Correctness Bounds for ML-KEM-768 at the Heuristic Failure Scale
A certified honest-decapsulation failure upper bound of 2^-164.81 within an explicit random-function/centered-binomial abstraction
Aurélie Duriez; Christophe Tommasini· 2026· DOI 10.48550/arXiv.2609.09983
The core problem
ML-KEM-768, standardized in FIPS 203, relies on a heuristic decapsulation-failure scale whose rigorous justification has been identified as an open problem by recent formal assessments. Duriez and Tommasini address this gap within an explicit random-function/centered-binomial (ROM/CBD) abstraction. In this model, domain-separated public-matrix streams are treated as independent uniform ring elements, and secret/noise polynomials as independent CBD2 primitives. The authors emphasize that this is not an information-theoretic statement about the fixed SHAKE instantiation of FIPS 203. Their goal is to obtain a dependency-preserving certified upper bound at the heuristic scale, accounting for dependencies induced by the public matrix and by both ciphertext-compression terms. The result is an upper bound for an arbitrary message fixed independently of the public and secret randomness, under honest encryption and decapsulation. It is explicitly not an exact DFR, not a fixed-SHAKE equivalence theorem, not a new IND-CCA reduction, and not an adaptive delta-correctness result.
Innovation
The main result is a certified upper bound on the honest-decapsulation failure probability for ML-KEM-768 within the ROM/CBD abstraction. Specifically, the reduced rational certificate yields:
and the certified exponent is
The bound is tight at the heuristic failure scale: the certified exponent exceeds 164.81 by only about 0.0007162 bit, and the next threshold 164.82 is not certified. This means the result sits extremely close to the 164.81 boundary, reflecting the precision of the dependency-aware analysis. The upper bound holds for an arbitrary message fixed independently of the public and secret randomness, under honest encryption and decapsulation. The authors stress that this is not an exact DFR, not a fixed-SHAKE equivalence theorem, not a new IND-CCA reduction, and not an adaptive delta-correctness result. The numerical tightness underscores the care required when interpreting the heuristic scale.
ML-KEM-768, standardized in FIPS 203, relies on a heuristic decapsulation-failure scale whose rigorous justification has been identified as an open problem by recent formal assessments. Duriez and Tommasini address this gap within an explicit random-function/centered-binomial (ROM/CBD) abstraction. In this model, domain-separated public-matrix streams are treated as independent uniform ring elements, and secret/noise polynomials as independent CBD2 primitives. The authors emphasize that this is not an information-theoretic statement about the fixed SHAKE instantiation of FIPS 203. Their goal is to obtain a dependency-preserving certified upper bound at the heuristic scale, accounting for dependencies induced by the public matrix and by both ciphertext-compression terms. The result is an upper bound for an arbitrary message fixed independently of the public and secret randomness, under honest encryption and decapsulation. It is explicitly not an exact DFR, not a fixed-SHAKE equivalence theorem, not a new IND-CCA reduction, and not an adaptive delta-correctness result.
The analysis constructs a terminal chain with three components. First, an exact graph-coupled full-ideal reference for the joint c_u/c_v residual is established. Second, a proper-ideal bivariate Fourier transport is applied, where the rare |T| >= 3 branch is closed by an exhaustive three-factor anti-concentration replay. Third, exact bit-specific FIPS decoding events are followed only by a 256-coordinate union bound. A formal partial-Fourier lemma makes the spectral-to-total-variation step explicit. The reduced rational certificate satisfies:
Why it matters
The work provides a rigorous, dependency-preserving certification of ML-KEM-768's decapsulation-failure scale within an explicit ROM/CBD abstraction, addressing an open problem highlighted by recent formal assessments. By modeling public-matrix streams as independent uniform ring elements and secret/noise polynomials as independent CBD2 primitives, the analysis captures dependencies induced by the public matrix and both ciphertext-compression terms. The three-component terminal chain—graph-coupled full-ideal reference, bivariate Fourier transport with anti-concentration replay, and bit-specific FIPS decoding with a 256-coordinate union bound—makes the spectral-to-total-variation step explicit via a formal partial-Fourier lemma. The resulting bound, Pr[K' != K] <= P_* <= 2^-164.81, is exact but numerically tight, with the certified exponent exceeding the threshold by only about 0.0007162 bit. The authors caution that this is not an information-theoretic statement about the fixed SHAKE instantiation of FIPS 203, nor an exact DFR, fixed-SHAKE equivalence theorem, IND-CCA reduction, or adaptive delta-correctness result. The findings offer a certified upper bound for an arbitrary message fixed independently of the public and secret randomness, under honest encryption and decapsulation, and highlight the precision required to justify heuristic failure scales in post-quantum cryptography.
Who should read this
CS practitioners and researchers
Opening member content…