Relaxing Chosen-Ciphertext Security

Abstract

Security against adaptive chosen ciphertext attacks (or, CCA security) has been accepted as the standard requirement from encryption schemes that need to withstand active attacks. In particular, it is regarded as the appropriate security notion for encryption schemes used as components within general protocols and applications. Indeed, CCA security was shown to suffice in a large variety of contexts. However, CCA security often appears to be somewhat too strong: there exist encryption schemes (some of which come up naturally in practice) that are not CCA secure, but seem sufficiently secure "for most practical purposes." We propose a relaxed variant of CCA security, called Replayable CCA (RCCA) security. RCCA security accepts as secure the non-CCA (yet arguably secure) schemes mentioned above; furthermore, it suffices for most existing applications of CCA security. We provide three formulations of RCCA security. The first one follows the spirit of semantic security and is formulated via an ideal functionality in the universally composable security framework. The other two are formulated following the indistinguishability and non-malleability approaches, respectively. We show that the three formulations are equivalent in most interesting cases.

Detecting Dangerous Queries: A New Approach for Chosen Ciphertext Security

“…One interesting class of relaxations is the notion of Replayable Chosen Ciphertext Security [8] and other similar works [29,1]. These works aim to capture the concept that some malleability attacks might intuitively be benign.…”

“…In [8], the authors gave an example of an RCCA scheme that could not be publicly detected. Conversely, not all DCCA schemes will be RCCA secure.…”

“…Our bit encryption instance serves as an example. We also note that [8] discusses a notion of detectability and introduces a definition that combines replayable and detectable properties. This combined definition is a particular instance of DCCA.…”

Efficient Unidirectional Proxy Re-Encryption

“…These techniques for unidirectional transformation and ciphertext validity checking intrinsically require the pairings. Moreover, the security guarantee provided by LV08 is only against replayable chosen-ciphertext attacks (RCCA) [CKN03], a weaker variant of CCA tolerating a "harmless mauling" of the challenge ciphertext.…”

Universally Anonymizable Public-Key Encryption

“…In [11], Hayashi and Tanaka also employed the same restriction in order to prove the anonymity of their encryption scheme. Incidentally, Canetti, Krawczyk, and Nielsen [4] proposed a relaxed notion of CCA security, called Replayable CCA (RCCA). In their security model, the schemes which require restriction such as equivalence class for proving their CCA security satisfy a variant of RCCA, pd-RCCA (publicly-detectable replayable-CCA) secure.…”