Bounded CCA2-Secure Encryption

Abstract

Whereas encryption schemes withstanding passive chosenplaintext attacks (CPA) can be constructed based on a variety of computational assumptions, only a few assumptions are known to imply the existence of encryption schemes withstanding adaptive chosen-ciphertext attacks (CCA2). Towards addressing this asymmetry, we consider a weakening of the CCA2 model-bounded CCA2-security-wherein security needs only hold against adversaries that make an a-priori bounded number of queries to the decryption oracle. Regarding this notion we show (without any further assumptions):-For any polynomial q, a simple black-box construction of q-bounded IND-CCA2-secure encryption schemes, from any IND-CPA-secure encryption scheme. When instantiated with the Decisional Diffie-Hellman (DDH) assumption, this construction additionally yields encryption schemes with very short ciphertexts.-For any polynomial q, a (non-black box) construction of q-bounded NM-CCA2-secure encryption schemes, from any IND-CPA-secure encryption scheme. Bounded-CCA2 non-malleability is the strongest notion of security yet known to be achievable assuming only the existence of IND-CPA secure encryption schemes. Finally, we show that non-malleability and indistinguishability are not equivalent under bounded-CCA2 attacks (in contrast to general CCA2 attacks).

On the Impossibility of Constructing Efficient Key Encapsulation and Programmable Hash Functions in Prime Order Groups

“…These results imply that the approach of minimizing ciphertext overhead in the above mentioned schemes [28,22,34], by compressing group elements using a target collision resistant hash function (or a similar primitive), will not yield CCA secure or non-malleable KEMs based on non-interactive assumptions. Additionally, since the DDH-based KEM by Cramer et al [13] is contained in the KEM class, the results imply that this scheme cannot be shown fully CCA secure or non-malleable based on any non-interactive assumption. See Section 3 for a definition of the class of KEMs we consider, Section 4 for our main impossibility result, and Section 6 for further discussion about the implications and limitations of our results.…”

“…The class of KEMs we consider essentially captures the structure of the existing KEMs defined in standard prime order groups like Cramer-Shoup [14], Kurosawa-Desmedt [34] (with explicit rejection), Hofheinz-Kiltz [28], Hanaoka-Kurosawa [22], and Cramer et al [13], but requires the ciphertexts to consist of a single random group element and a string i.e. a ciphertext is required to be of the form (g r , f (pk, r)) where r ← Z p , p is the order of the group, pk is the public key of the scheme, f : PK × Z p → {0, 1} * is a scheme-dependent function, and PK is the public key space..…”

“…Boyen-Mei-Waters [8]. Furthermore, note that the DDHbased KEM by Cramer et al [13] achieves a ciphertext overhead of just a single group element, but can only be shown to be q-bounded CCA secure (for a predetermined number of decryption queries q).…”

Detecting Dangerous Queries: A New Approach for Chosen Ciphertext Security

“…al. [11], which is signficantly more efficient and simpler than the nonmalleable systems of either PSV [24] or Choi et. al.…”

“…Our construction will build a chosen ciphertext secure system from three components: a chosen plaintext secure system, 1-bounded CCA-secure system 2 , and a detectable CCA-secure system. Since DCCA security (trivially) implies CPA, and we can build 1-bounded CCA from CPA encryption [24,11,10], it follows that all components are realizable from DCCA as a building block.…”