Bounded CCA2-secure encryption

  • Authors:
  • Ronald Cramer;Goichiro Hanaoka;Dennis Hofheinz;Hideki Imai;Eike Kiltz;Rafael Pass;Abhi Shelat;Vinod Vaikuntanathan

  • Affiliations:
  • Centrum voor Wiskunde en Informatica, Amsterdam and Leiden University;National Institute of Advanced Industrial Science and Technology, Tokyo;Centrum voor Wiskunde en Informatica, Amsterdam;National Institute of Advanced Industrial Science and Technology, Tokyo and Chuo University;Centrum voor Wiskunde en Informatica, Amsterdam;Cornell University;University of Virginia;Massachusetts Institute of Technology

  • Venue:
  • ASIACRYPT'07 Proceedings of the Advances in Crypotology 13th international conference on Theory and application of cryptology and information security
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Whereas encryption schemes withstanding passive chosen-plaintext attacks (CPA) can be constructed based on a variety of computational assumptions, only a few assumptions are known to imply the existence of encryption schemes withstanding adaptive chosen-ciphertext attacks (CCA2). Towards addressing this asymmetry, we consider a weakening of the CCA2 model--bounded CCA2-security -- wherein security needs only hold against adversaries that make an a-priori bounded number of queries to the decryption oracle. Regarding this notion we show (without any further assumptions): - For any polynomial q, a simple black-box construction of q-bounded IND-CCA2-secure encryption schemes, from any IND-CPA-secure encryption scheme. When instantiated with the Decisional Diffie-Hellman (DDH) assumption, this construction additionally yields encryption schemes with very short ciphertexts. - For any polynomial q, a (non-black box) construction of q-bounded NM-CCA2-secure encryption schemes, from any IND-CPA-secure encryption scheme. Bounded-CCA2 non-malleability is the strongest notion of security yet known to be achievable assuming only the existence of IND-CPA secure encryption schemes. Finally, we show that non-malleability and indistinguishability are not equivalent under bounded-CCA2 attacks (in contrast to general CCA2 attacks).