Chosen-Ciphertext Secure RSA-Type Cryptosystems

  • Authors:
  • Benoît Chevallier-Mames;Marc Joye

  • Affiliations:
  • Laboratoire Crypto, DCSSI, Paris, France 75700;Thomson R&D, Security Competence Center, Cesson-Sééévigné Cedex, France 35576

  • Venue:
  • ProvSec '09 Proceedings of the 3rd International Conference on Provable Security
  • Year:
  • 2009

Quantified Score

Hi-index 0.01

Visualization

Abstract

This paper explains how to design fully secure RSA-type cryptosystems from schemes only secure against passive attacks, in the standard model. We rely on instance-independence assumptions, which, roughly speaking, conjecture that for certain problems, an interactive access to a solver for another problem does not help the challenger. Previously, instance-independence assumptions were used in a "negative" way, to prove that certain schemes proven in the random oracle model were not provable in the standard model. Our paradigm applies virtually to all (weakly secure) RSA-type encryption schemes for which public-key RSA exponent can be arbitrarily chosen. As an illustration, we present a chosen-ciphertext secure variant of the Naccache-Stern encryption scheme.