Design and Analysis of Practical Public-Key Encryption Schemes Secure against Adaptive Chosen Ciphertext Attack

Abstract

A new public-key encryption scheme, along with several variants, is proposed and analyzed. The scheme and its variants are quite practical and are proved secure against adaptive chosen ciphertext attack under standard intractability assumptions. These appear to be the first public-key encryption schemes in the literature that are simultaneously practical and provably secure. Introduction.In this paper, we present and analyze a new public-key encryption scheme, and several variants, proving that they are secure against adaptive chosen ciphertext attack (as defined by Rackoff and Simon [50]) under standard intractability assumptions. The schemes are quite practical, requiring just a few exponentiations in a group for both encryption and decryption. Moreover, the proofs of security of these schemes rely only on standard intractability assumptions: one variant relies only on the hardness of the decisional Diffie-Hellman problem, while other, somewhat more practical, variants rely on a couple of other standard intractability assumptions.The hardness of the decisional Diffie-Hellman problem is essentially equivalent to the semantic security of the basic ElGamal encryption scheme [30]. Thus, with just a bit more computation, we get security against adaptive chosen ciphertext attack, whereas the basic ElGamal scheme is completely insecure against this type of attack.While there are several provably secure public-key encryption schemes in the literature, they are all quite impractical. Also, there are several practical encryption schemes that have been proposed, but none of them has been proven secure under standard intractability assumptions. The significance of our results is that they provide several schemes that are provably secure and practical at the same time. There appear to be no other public-key encryption schemes in the literature that enjoy both of these properties simultaneously.

A New Paradigm of Hybrid Encryption Scheme

“…Cramer and Shoup showed the first provably secure practical public-key encryption scheme in the standard model [3,6]. It is secure against adaptive chosen ciphertext attack (IND-CCA) under the Decisional Diffie-Hellman (DDH) assumption.…”

“…For hybrid encryption schemes, Shoup formalized the notion of a key encapsulation mechanism (KEM), and an appropriate notion of security against adaptive chosen ciphertext attack [12,6]. A KEM works just like a public key encryption scheme, except that the encryption algorithm takes no input other than the recipient's public key.…”

Chosen Ciphertext Secure Public Key Threshold Encryption Without Random Oracles

“…Recall that the Cramer-Shoup system [11] and its variants [33,28] provide efficient chosen ciphertext secure encryption without random oracles. All these systems require that the private key be used to test ciphertext validity during decryption.…”

Efficient Identity-Based Key Encapsulation to Multiple Parties

“…The hybrid public key encryption paradigm has gained strength in recent years with the definition and formal security analysis of the generic KEM-DEM construction [7,8,17]. In this approach to hybrid encryption one defines a symmetric data encapsulation mechanism (DEM) which takes a key k and a message M and computes C ← DEM k (M ).…”

“…In fact, Cramer and Shoup [7] established that an hybrid encryption scheme is IND-CCA2 secure, if both the KEM and DEM modules are semantically secure [9] against adaptive chosen ciphertext attacks [14] (see Theorems 4 and 5 in [7]). …”