Imagine two people who have never met in person but need to exchange sensitive documents over an open network. They agree on a single memorable password in advance and nothing else. The sender creates an encrypted message that only the recipient can open with that same password. No certificates, no trusted middleman, and no pre-installed keys are required. This capability comes from a cryptographic approach called password-authenticated public-key encryption, or PAPKE. It combines the convenience of a low-entropy password with the strength of public-key methods to deliver both secrecy and authenticity in one package. The resulting ciphertext reveals nothing useful to an eavesdropper and cannot be forged without knowledge of the password. Because the recipient’s authenticated public key can be reused across multiple messages, the system supports one-way communication without requiring both parties to be online simultaneously.[1]
An authenticated public key is the recipient’s normal public key that has been combined with the shared password through a one-time wrapping step performed by the recipient during setup. This wrapping creates a single, reusable object that looks like random data to anyone who does not know the password yet reveals the real public key to anyone who does. A sender who receives this wrapped object and knows the password can open it to obtain the underlying public key and then lock their message to that key so only the recipient can read it. The recipient, holding the matching private key, can open every message created this way without needing any additional information from the sender. In practice, the authenticated public key therefore acts as a password-gated address that anyone who shares the password can use to reach the recipient securely, while the password itself never travels with the messages.
This reusability makes PAPKE especially valuable in settings where traditional public-key infrastructure is difficult or impossible to maintain. Consider Internet of Things sensors deployed in remote locations. Each device may need to receive configuration updates or report data, yet installing and managing individual certificates on thousands of low-power units creates logistical and security headaches. A shared password known only to the device and its controller allows secure delivery without that overhead. Similarly, two colleagues exchanging large files through peer-to-peer software can establish protection with nothing more than a verbal password shared over the phone. Ephemeral wireless sessions or onboarding processes for new equipment benefit in the same way. In all these cases, the password serves as the sole shared secret, while the underlying public-key mechanisms provide strong encryption and resistance to tampering that simple password-only methods lack.
Earlier attempts to extend PAPKE to resist quantum computers ran into a practical barrier. A generic construction existed that could pair any public-key encryption scheme with the password-authentication layer. That construction relied on an ideal cipher, a theoretical tool that behaves like a perfect, unpredictable substitution table mapping every possible input to a random output. When the public keys involved are small, an ideal cipher can be approximated reasonably well. Post-quantum public-key schemes, however, typically produce keys that are hundreds or thousands of bytes long. Building a practical ideal cipher over such a vast space proved inefficient. Standard block ciphers operate on fixed small blocks, while attempts to stretch them with multiple rounds or domain-extension techniques added substantial computational cost and risked weakening the security guarantees if implemented carelessly.
In the paper titled “HIC Is All You Need: Practical Post-Quantum Password-Authenticated Public-Key Encryption,” researchers addressed this limitation by replacing the full ideal cipher with a simpler component called a half-ideal cipher. The half-ideal cipher still provides strong randomness and commitment properties where they matter most for security, yet it confines the most demanding part of the ideal-cipher behavior to a small, fixed-size domain of ordinary bit strings. Inside the construction, a lightweight two-round Feistel network combined with ordinary hash functions and a standard block cipher handles the heavy lifting. Because the block cipher operates on 256-bit strings rather than the entire public-key space, it can be instantiated efficiently using well-understood algorithms available in cryptographic libraries. The password-protected public key is produced simply by wrapping the ordinary public key with this half-ideal cipher under the shared password. Encryption then proceeds by first recovering the public key using the same password and half-ideal cipher, after which any standard encryption operation is applied to the message. Decryption uses only the recipient’s private key, as usual.
This design preserves every security property of the earlier approach while removing the performance bottleneck. The researchers also strengthened the underlying security argument. While reviewing the proof of the previous construction, they identified a small but important gap: the analysis had not fully accounted for the possibility that an adversary might craft a ciphertext that decrypts successfully even though the adversary never learned the public key. They formalized a new requirement, called decryption robustness under chosen-ciphertext attacks, that rules out such forgeries. The property is satisfied directly by many existing post-quantum schemes, particularly those built from key-encapsulation mechanisms that incorporate the public key during key derivation and pair it with an authenticated symmetric encryption layer. For schemes that do not meet the condition out of the box, a modest transformation restores the needed guarantee without changing the overall performance profile.
Because the new construction works with any public-key encryption scheme that meets a short list of well-understood properties, it integrates cleanly with leading post-quantum candidates. Systems based on module-lattice techniques function with only minor adjustments. Code-based schemes require one additional hashing step, which the authors provide, after which they behave correctly. The researchers implemented both the new approach and the earlier ideal-cipher version across several parameter sets and measured the running times on ordinary hardware. Encryption under the new method completed in a few milliseconds for lattice-based schemes and remained competitive even for the largest code-based keys, whereas the older method’s domain-extension variant required orders of magnitude more time. These measurements confirm that the half-ideal-cipher route delivers the first genuinely practical post-quantum PAPKE.
The practical consequences extend beyond laboratory benchmarks. Organizations that must secure communications among devices lacking persistent storage or reliable network access now have a concrete path to quantum-resistant protection that relies only on a password. Peer-to-peer file-sharing tools can incorporate the technique without forcing users to manage certificates. Proposals to extend wireless security standards to support multiple passwords gain a post-quantum foundation that adds negligible communication overhead. Because the scheme is proven secure in the universal-composability framework, it can be combined safely with other protocols without introducing hidden weaknesses.
Looking ahead, the research provides both a ready-to-use primitive and a clearer set of requirements that future post-quantum encryption schemes should satisfy to support password-authenticated constructions. Standardization bodies can now evaluate concrete parameter choices and integration patterns. Researchers interested in lifting similar proofs into the quantum random-oracle model have a well-documented starting point. Implementers gain guidance on which existing post-quantum libraries already contain the necessary building blocks. The net result is a bridge between theoretical password-authenticated encryption and deployable systems that remain secure even if large-scale quantum computers become available.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://six3ro.substack.com/p/a-password-is-all-you-need-for-quantum
Comments