conservative code-based cryptography

ly, we are building a correct KEM given a correct deterministic PKE. We want the KEM to achieve IND-CCA2 security, and we want this to be proven to the extent possible, assuming that the PKE achieves OW-CPA security. The PKE functionality is as follows. There is a set of public keys, a set of private keys, a set of plaintexts, and a set of ciphertexts. There is a key-generation algorithm KeyGen that produces a public key and a private key. There is a deterministic encryption algorithm Encrypt that, given a plaintext and a public key, produces a ciphertext. There is a decryption algorithm Decrypt that, given a ciphertext and a private key, produces a plaintext or a failure symbol ⊥ (which is not a plaintext). We require that Decrypt(Encrypt(p,K), k) = p for every (K, k) output by KeyGen() and every plaintext p. We emphasize that Encrypt is not permitted to randomize its output: in other words, any randomness used to produce a ciphertext must be in the plaintext recovered by decryption. We also emphasize that Decrypt is not permitted to fail on valid ciphertexts; even a tiny failure probability is not permitted. These requirements are satisfied by the PKE in this submission, and the literature indicates that these requirements are helpful for security proofs. In this level of generality, our KEM is defined in two modular layers as follows, using three hash functions H0, H1, H2. These hash functions can be modeled in proofs as independent random oracles. If the hash output spaces are the same then this is equivalent to defining Hi(x) = H(i, x) for a single random oracle H, since the input spaces are disjoint. First layer. Write X for the original correct deterministic PKE. We define a modified PKE X2 = ConfirmPlaintext(X,H2) as follows. This modified PKE is also a correct deterministic PKE. The modified key-generation algorithm KeyGen2 is the same as the original key-generation algorithm KeyGen. The set of public keys is the same, and the set of private keys is the same. The modified encryption algorithm Encrypt2 is defined by Encrypt2(p,K) = (Encrypt(p,K),H2(p)). The set of plaintexts is the same, and the modified set of ciphertexts consists of pairs of original ciphertexts and hash values. Finally, the modified decryption algorithm Decrypt2 is defined by Decrypt2((C, h), k) = Decrypt(C, k). Note that Decrypt2 does not check hash values: changing (C, h) to a different (C, h ′) produces the same output from Decrypt2. There was also no requirement for the original PKE X to recognize invalid ciphertexts.