Achieving CCA security from DCCA security more efficiently by using the KEM+DEM hybrid paradigm

Abstract

Detectable Chosen Ciphertext (DCCA) security is a useful notion to achieve CCA security for public-key encryptions (PKE). An "inner-outer" structure can transform a DCCA-secure PKE into a CCA-secure one. In the structure, the "inner" layer encrypts both the message and the two embedded randomness, so a key encapsulated mechanism (KEM) + data encapsulation mechanism (DEM) hybrid paradigm helps to gain time efficiency. Nevertheless, the long "inner" ciphertext still makes the "outer" encryption less efficient. We show that the structure can be applied solely on the KEM part, and even the embedded randomness can be encrypted outside the structure by introducing a CCA-secure DEM. These reduce the length of the "inner" ciphertext, thus avoiding some redundant re-encryptions in the "outer" layer and offload as much of the work as possible from KEMs to faster DEMs. Combined with a recent improvement made on the "outer" layer, we can gain better time and space efficiency. Additionally, we prove that when a DCCA-secure KEM satisfies the so-called "translatability", a proper related-key secure DEM helps to achieve CCA security directly by applying the hybrid paradigm without any use of the less efficient "inner-outer" structure. Achieving CCA security from DCCA security more efficiently Note that we add more dangerous ciphertexts here to show the sufficiency. Security Comm. Networks 2015; 8:3323-3334Achieving CCA security from DCCA security more efficiently KEM dcca . We denote the scheme as KEM cca =