Short answer: The Fujisaki-Okamoto transform turns a basic public-key encryption scheme into one secure against chosen-ciphertext attacks in the random oracle model, and many key encapsulation designs use it. Papers from 2019, 2023 and 2024 study its security in the quantum random oracle model: tighter proofs in 2019, security against quantum chosen-ciphertext attacks in 2023 and 2024. This is proof research about idealised models and says nothing about a deployed implementation.

What the transform does

A 2023 ePrint paper explains that the Fujisaki-Okamoto transformation (CRYPTO 1999, Journal of Cryptology 2013) and its key encapsulation variants (TCC 2017) are used to construct IND-CCA secure encryption or key encapsulation in the random oracle model. For the post-quantum setting the model is extended to the quantum random oracle model, where the adversary can query the oracle in superposition, and IND-CCA security of the transform in that model has been extensively analysed.

Tighter proofs in 2019

A 2019 ePrint paper recalls that Hofheinz, Hovelmanns and Kiltz (TCC 2017) gave a modular toolkit of generic key encapsulation constructions, widely used among post-quantum KEM designs. Their security in the quantum model had been analysed by several groups, but the proofs from standard assumptions were far from tight: the security loss factor was q, with degree 2, where q is the total number of adversarial oracle queries. Using the semi-classical oracle technique, the 2019 authors reduce the factor q to the square root of q, and for the transformation that derandomizes and re-encrypts, reduce the degree of loss from 2 to 1. They say tighter proofs give more confidence in designs that use these generic transformations.

Quantum chosen-ciphertext attacks

The 2023 paper notes that later work looked at properties beyond IND-CCA, such as anonymity under chosen-ciphertext attacks, and that Boneh and Zhandry (CRYPTO 2013) considered quantum adversaries who perform quantum chosen-ciphertext attacks, called qCCA. The authors say few results existed on IND-qCCA or ANO-qCCA security of the transform. They define a class of games called oracle-hiding games and prove a lifting theorem that carries a security reduction in the classical random oracle model over to the quantum one, and use it to prove IND-qCCA and ANO-qCCA security for several variants.

A 2024 Springer paper analyses IND-qCCA security of the transform in the quantum model. It recalls that Liu and Wang (PKC 2021) proved it for the implicit rejection variant at the cost of an extra hash, and that Ge, Shan and Xue (CRYPTO 2023) proved it for the explicit rejection variant if the underlying encryption is gamma-spread. The authors remove the extra hash for implicit rejection, show an example of a secure encryption scheme that is not gamma-spread, and remove the spreadness requirement for explicit rejection, at the cost of an additional hash.

What this does not tell you

These are security proofs in an idealised model, with their own assumptions and costs, such as extra hashes or spreadness conditions. They do not evaluate a specific implementation.

FAQ

What does the Fujisaki-Okamoto transform give you?

A route from a weaker encryption scheme to IND-CCA security in the random oracle model.

Why a quantum version?

Adversaries may query the oracle in superposition, which changes the proof techniques.

What did the 2019 paper improve?

The security loss factor went from q to the square root of q, and the degree from 2 to 1 for one transformation.

What is qCCA?

Chosen-ciphertext attacks by quantum adversaries, considered by Boneh and Zhandry in 2013.

Does this mean a scheme is secure in practice?

No. The results are proofs under stated assumptions.

All field notes