Do any NIST PQC have "homomorphic" public keys, in the sense that any two pubkeys derive a combination pubkey? Background:

The MathMesh crypto platform (refs at the bottom) is a newly-proposed technology stack which has been somewhat cheekily called a "Grand Unified Theory of Security on the Internet". Its "Meta Cryptography" module relies on the following property of Discrete-log Diffie-Hellman:

$privKey: x, pubKey: X = x.P$

$privKey: y, pubKey: Y = y.P$

Therefore you can derive "combination keys" by either combining two public keys or two private keys. 

$Z=X \oplus Y = (x \otimes y).P$

for some appropriate definition of $\oplus$ and $\otimes$.

Question:

Will this survive the transition to post-quantum asymmetric KEMs? More specifically, how likely is it that there is some definition of $\oplus$ and $\otimes$ that allows "combining" of public keys and private keys in this way for lattice, code, multivariate and/or SIKE keys?

References:


https://mathmesh.com/
7 hours of youtube video
IETF 106 slides, specifically see slides 23-27.
No, this does not survive as is in the quantum world, since all discrete logarithm schemes (including Diffie-Hellman) are broken.

And more generally, this is probably not possible in the quantum world a priori, because it would imply having group homomorphic properties, which are hindered by the fact that Shor's algorithm is actually made of two parts:


A reduction of the factoring problem to the problem of order-finding.
A quantum algorithm to solve the order-finding problem


and the problem is that the order finding part implies that it allows to find the order of a group element, thus allowing to break the discrete logarithm easily.

There is even an impossibility result from 2014 for group homomorphic encryption in the quantum world.
Its core idea is basically that you can win the IND-CPA game by choosing two messages $m_0$ and $m_1$ such that $m_0=e$, and $m_1\neq e$, for $e$ the identity element in your plaintext group, which will be mapped when encrypted to the identity element of the ciphertext group, and since you can compute the order of an element using Shor's order finding part, you can find whether the ciphertext has order 1 (in which cases it corresponds to $m_0$) or not.
And the same kind of problems will arise with digital signatures or key exchanges algorithms.

This is also the reason why it is extremely difficult to come up with zero-knowledge proofs that are quantum safe.