A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack

Cramer, Ronald; Shoup, Victor

doi:10.1007/bfb0055717

Cited by 1,010 publications

(793 citation statements)

References 23 publications

Supporting

Mentioning

758

Contrasting

Unclassified

Order By: Relevance

“…First, our protocol uses the Cramer-Shoup cryptosystem [13] which is secure under adaptive chosen-ciphertext attack. Actually, we require an extension of the CramerShoup cryptosystem, which remains secure under adaptive chosen-ciphertext attack.…”

Section: Building Blocksmentioning

confidence: 99%

See 1 more Smart Citation

Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords

Katz

Ostrovsky²,

Yung

2001

Lecture Notes in Computer Science

316

248

View full text Add to dashboard Cite

Abstract. There has been much interest in password-authenticated keyexchange protocols which remain secure even when users choose passwords from a very small space of possible passwords (say, a dictionary of English words). Under this assumption, one must be careful to design protocols which cannot be broken using off-line dictionary attacks in which an adversary enumerates all possible passwords in an attempt to determine the correct one. Many heuristic protocols have been proposed to solve this important problem. Only recently have formal validations of security (namely, proofs in the idealized random oracle and ideal cipher models) been given for specific constructions [3,10,22].Very recently, a construction based on general assumptions, secure in the standard model with human-memorable passwords, has been proposed by Goldreich and Lindell [17]. Their protocol requires no public parameters; unfortunately, it requires techniques from general multi-party computation which make it impractical. Thus, [17] We show an efficient, 3-round, password-authenticated key exchange protocol with human-memorable passwords which is provably secure under the Decisional Diffie-Hellman assumption, yet requires only (roughly) 8 times more computation than "standard" Diffie-Hellman key exchange [14] (which provides no authentication at all). We assume public parameters available to all parties. We stress that we work in the standard model only, and do not require a "random oracle" assumption.

show abstract

Section: Building Blocksmentioning

confidence: 99%

“…This lemma essentially follows from the chosen-ciphertext security (and hence non-malleability) of extended Cramer-Shoup encryption (see [13] and Appendix B). Detail appear in the full proof, below.…”

mentioning

confidence: 99%

Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords

Katz

Ostrovsky²,

Yung

2001

Lecture Notes in Computer Science

316

248

View full text Add to dashboard Cite

show abstract

“…We employ the idea described in [5] by Cramer and Shoup. We can encode the elements of QR p where p = 2q + 1 and p, q are prime to those of Z q .…”

Section: Expandc To the Common Domain (The Expanding Technique)mentioning

confidence: 99%

“…Cramer and Shoup [5] proved that the Cramer-Shoup encryption scheme is secure in the sense of IND-CCA2 assuming that H is universal one-way and the DDH problem for Q is hard. Lucks [12] recently proposed a variant of the Cramer-Shoup encryption scheme for groups of unknown order.…”

Section: The Cramer-shoup Encryption Scheme Definition 12 (Cramer-shomentioning

confidence: 99%

“…Therefore, we cannot straightforwardly apply their argument to our schemes. To prove the key-privacy property of our schemes, we employ the idea described in [5] by Cramer and Shoup, where we encode the elements of QR p (a group of quadratic residues modulo p) where p = 2q+1 and p, q are prime to those of Z q . This encoding plays an important role in our schemes.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Universally Anonymizable Public-Key Encryption

Hayashi

Tanaka

2005

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We first propose the notion of universally anonymizable publickey encryption. Suppose that we have the encrypted data made with the same security parameter, and that these data do not satisfy the anonymity property. Consider the situation that we would like to transform these encrypted data to those with the anonymity property without decrypting these encrypted data. In this paper, in order to formalize this situation, we propose a new property for public-key encryption called universal anonymizability. If we use a universally anonymizable public-key encryption scheme, not only the person who made the ciphertexts, but also anyone can anonymize the encrypted data without using the corresponding secret key. We then propose universally anonymizable public-key encryption schemes based on the ElGamal encryption scheme, the Cramer-Shoup encryption scheme, and RSA-OAEP, and prove their security.

show abstract

Attribute‐Based Encryption

2023

Attribute‐based Encryption (ABE)

View full text Add to dashboard Cite

A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack

Cited by 1,010 publications

References 23 publications

Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords

Efficient Password-Authenticated Key Exchange Using Human-Memorable Passwords

Universally Anonymizable Public-Key Encryption

Attribute‐Based Encryption

Contact Info

Product

Resources

About