Tag-KEM/DEM: A New Framework for Hybrid Encryption and A New Analysis of Kurosawa-Desmedt KEM

Abstract

Abstract. This paper presents a novel framework for generic construction of hybrid encryption schemes secure against chosen ciphertext attack. Our new framework yields new and more efficient CCA-secure schemes, and provides insightful explanations about existing schemes that do not fit into the previous frameworks. This could result in finding future improvements. Moreover, it allows immediate conversion from a class of threshold public-key encryption to a hybrid one without considerable overhead, which is not possible in the previous approaches.Finally we present an improved security proof of the KurosawaDesmedt scheme, which removes the original need for informationtheoretic key derivation and message authentication functions. We show that the scheme can be instantiated with any computationally secure such functions, thus extending the applicability of their paradigm, and improving its efficiency.

Efficient Chosen Ciphertext Secure Public Key Encryption under the Computational Diffie-Hellman Assumption

“…It is well-known that by combining a CCA-secure KEM and a CCA-secure data encryption mechanism (DEM), a CCA-secure PKE scheme is generically obtained [38], and furthermore, there exist some other flexible methods for hybrid encryption as well [1,22]. It is also known that a CCA-secure DEM can be generically constructed from any pseudorandom functions without redundancy [27,33].…”

“…Furthermore, this security also implies universally composable security [11]. So far, many CCA-secure PKE schemes have been proposed, both theoretical ones [31,16,36] and practical ones [14,38,12,26,10,1,25,22], and their security are proven under existence of enhanced trapdoor permutations (for theoretical schemes) or under various number theoretic assumptions (for practical schemes). Theoretical schemes pursue weaker assumptions and practical schemes pursue efficiency.…”

“…1 How to Achieve CCA Security. Naor and Yung showed that a non-adaptively CCA-secure encryption scheme can be constructed from any semantically secure encryption [19] and non-interactive zero knowledge (NIZK) proof [4].…”

Public Key Encryption for the Forgetful

“…The main procedure of a PKE-BR scheme can be divided into the following phases. From the above procedure, one can see that when a weak public key encryption scheme is applied, m may be potentially leaked and/or modified during any of the following three phases: (1) transmission from Alice to Bob, (2) residing in the storage device of a MSTA, and (3) transmission from the MSTA back to Alice. This justifies the following three security requirements for PKE-BR:…”

“…It is known that a key encapsulation mechanism or KEM can be converted to a hybrid encryption [1]. Similar techniques can be applied to construct a PKE-BR scheme from a KEM-BR (KEM with backward recovery).…”