Amber: Lattice-Based Threshold KEM from the BCHK+ Transform

"Preview Talk" (by Team Amber) @ MPTS 2026, in reply to the NIST Threshold Call

Abstract: In this talk I will discuss a family of post-quantum threshold KEMs based on lattice assumptions. Using our BCHK+ transform we combine a threshold identity-based encryption (IBE) and a one-time signature to build a threshold KEM with strong security guarantees (e.g. IND-CCA2). I will discuss two possible instantiations of the threshold IBE and the corresponding security vs efficiency trade-offs including estimating the ciphertext sizes of the scheme. This construction uses light-weight lattice techniques, whereas the previous works could only achieve a post-quantum CCA secure threshold KEM using the machinery of fully homomorphic encryption (FHE), multi-party computation (MPC), or non-interactive zero-knowledge (NIZK).

Joint work: Katharina Boudgoust, Rafael del Pino, Oleksandra Lapiha, Thomas Prest.

[Slides] Suggested reading:

• Preview Writeup: Amber: a Family of Efficient Lattice-Based IND-CCA Threshold KEMs
• IND-CCA Lattice Threshold KEM under 30 KiB (ia.cr/2026/021)