Selective opening security of practical public‐key encryption schemes

Abstract

We show that two well-known and widely employed public-key encryption schemes-RSA Optimal Asymmetric Encryption Padding (RSA-OAEP) and Diffie-Hellman Integrated Encryption Scheme (DHIES), instantiated with a one-time pad,-are secure under (the strong, simulation-based security notion of) selective opening security against chosen-ciphertext attacks in the random oracle model. Both schemes are obtained via known generic transformations that transform relatively weak primitives (with security in the sense of one-wayness) to IND-CCA secure encryption schemes. We also show a similar result for the well-known Fujisaki-Okamoto transformation that can generically turn a one-way secure public key encryption system and a one-time pad into a INDCCA-secure public-key encryption system. We prove that selective opening security comes for free in these transformations. Both DHIES and RSA-OAEP are important building blocks in several standards for public key encryption and key exchange protocols. The Fujisaki-Okamoto transformation is very versatile and has successfully been utilised to build efficient lattice-based cryptosystems. The considered schemes are the first practical cryptosystems that meet the strong notion of simulation-based selective opening (SIM-SO-CCA) security.

Selective-Opening Security for Public-Key Encryption in the Presence of Parameter Subversion

“…ese scenarios usually require a set of senders to generate their own messages (possibly correlated) encrypted with the same receiver's public key and may suffer from some special attacks. One of the mostly studied attacks is selective opening attacks (SOA) [7][8][9][10][11][12][13][14][15][16][17][18], in which an attacker may corrupt a subset of the senders to open their ciphertexts as well as the corresponding random bits used in the encryption algorithm. Under such an attack, the requirement to guarantee the security of the unopened ciphertexts is beyond the capability of traditional IND-CPA/CCA security [14,15,19].…”