A Public Key Encryption Scheme Secure against
Key Dependent Chosen Plaintext and Adaptive
Chosen Ciphertext Attacks
Jan Camenisch1 , Nishanth Chandran2 , and Victor Shoup3
1
3
IBM Research, work funded by the European Community’s Seventh Framework
Programme (FP7/2007-2013) under grant agreement no. 216483
2
UCLA, work done while visiting IBM Research
NYU, work done while visiting IBM Research, supported by NSF award number
CNS-0716690
Abstract. Recently, at Crypto 2008, Boneh, Halevi, Hamburg, and Ostrovsky (BHHO) solved the long-standing open problem of “circular encryption,” by presenting a public key encryption scheme and proving
that it is semantically secure against key dependent chosen plaintext
attack (KDM-CPA security) under standard assumptions (and without
resorting to random oracles). However, they left as an open problem that
of designing an encryption scheme that simultaneously provides security
against both key dependent chosen plaintext and adaptive chosen ciphertext attack (KDM-CCA2 security). In this paper, we solve this problem.
First, we show that by applying the Naor-Yung “double encryption”
paradigm, one can combine any KDM-CPA secure scheme with any (ordinary) CCA2 secure scheme, along with an appropriate non-interactive
zero-knowledge proof, to obtain a KDM-CCA2 secure scheme. Second,
we give a concrete instantiation that makes use the above KDM-CPA secure scheme of BHHO, along with a generalization of the Cramer-Shoup
CCA2 secure encryption scheme, and recently developed pairing-based
NIZK proof systems. This instantiation increases the complexity of the
BHHO scheme by just a small constant factor.
1
Introduction
Encryption is the oldest cryptographic primitive; indeed, cryptography used to
be synonymous with encryption. Despite this, the right definition for the security of encryption schemes has still not been settled! The first formal definition
of security for public key encryption was that of semantic security [17], which,
loosely speaking, states that given an encryption of a message an adversary cannot learn any information about the message itself. As it turned out, this notion
of security does not offer sufficient protection for most practical applications [6],
as it does not take into account that an adversary could learn (partial information about) some plaintext when he has access to a decryption oracle. The
subsequent stronger notion of security against chosen ciphertext attacks (CCA2
security [31]) takes this into consideration and gives an adversary access to a
A. Joux (Ed.): EUROCRYPT 2009, LNCS 5479, pp. 351–368, 2009.
c International Association for Cryptologic Research 2009
352
J. Camenisch, N. Chandran, and V. Shoup
decryption oracle that will decrypt any ciphertext except a particular “challenge
ciphertext”. CCA2 security was considered the final answer with regard to the
security of public key encryption schemes.
However, none of the above notions of security allow an adversary to obtain
encryptions of secret keys or, more generally, functions of secret keys. Black,
Rogaway, and Shrimpton formally defined such a notion, calling it Key Dependent Message (KDM) security [5]. A similar notion, called circular security, was
earlier defined by Camenisch and Lysyanskaya [11] and used to prevent sharing
of credentials. Both papers provided constructions in the random oracle model.
Without resorting to the use of random oracles, constructing a public key
encryption scheme (practical or not) that is semantically secure against key dependent chosen plaintext attack (KDM-CPA) was a long-standing open problem.
It was only recently that Boneh et al. [9] gave a construction of a KDM-CPA
secure public key encryption scheme. They proved their scheme secure under
the Decisional Diffie-Hellman (DDH) assumption. We will refer to their scheme
as the BHHO scheme, which extends to obtain KDM-CPA security under the
more general K-linear assumption [36,27] (which includes the DDH assumption
for K = 1 and the DLIN assumption [8] for K = 2). However, Boneh et al. left
as an open problem the construction of an encryption scheme that is simultaneously secure against key dependent chosen plaintext and chosen ciphertext
attack (KDM-CCA2).
Our Contribution. In this paper, we solve this problem by constructing the first
KDM-CCA2 secure public key encryption scheme that can be proved secure
under standard assumptions, and without random oracles. In fact, we show that
a variation of the Naor-Yung paradigm [30] allows one to combine any KDMCPA secure encryption scheme and any regular CCA2 secure encryption scheme,
together with a non-interactive zero knowledge (NIZK) proof [7], to obtain a
KDM-CCA2 secure encryption scheme.
Moreover, we give a nearly practical instantiation of our general construction
using the BBHO KDM-CPA scheme, a K-linear version [14,36,23] of the CramerShoup [13] CCA2 scheme, and recently developed pairing-based NIZK proof
systems [19,18,20]. In the BHHO scheme, a ciphertext is a couple of hundred
group elements and our construction blows this up only be a small constant factor
(two or three, depending on the cryptographic assumption one employs). For our
construction, we need a pairing e : G × Γ → GT , and we prove security under
the K-linear assumption in G and the L-linear assumption in Γ , for appropriate
constants K and L (and we also need a collision-resistant hash function).
Motivational Example: Key-Wrap. The “key-wrap” problem motivates the need
for KDM-CCA2 secure encryption in practice. The key-wrap mechanism is found,
for instance, in cryptographic coprocessors such as IBM’s Common Cryptographic
Architecture [25] and RSA’s Public Key Cryptographic Standards [33]. Cryptographic coprocessors are tamper-proof hardware tokens that process requests from
applications to perform cryptographic tasks such as encryption, signing and so on.
One can view these tokens as trusted hardware that stores keys of all users in the
A Public Key Encryption Scheme Secure against Key Dependent
353
system. When an application (or user) wishes to perform a cryptographic task, it
authenticates itself to the token and the token processes the request. For the purpose of creating backup of data or to transport keys from one token to another, it is
often desired to encrypt keys (also known as “key wrapping”). Naturally, when we
encrypt private keys with other keys it might lead to a circularity. In other words,
an adversary might get to see an encryption of a secret key sk 1 with public key pk 2
as well as an encryption of a secret key sk 2 with public key pk 1 (such circularity
can in general be more complicated). Although one can circumvent this problem by
maintaining a hierarchy of keys and/or by maintaining separate keys for the purpose of wrapping other keys, this is not always convenient or possible. In addition,
since the hardware token performs decryption, an adversary may effectively have
access to a decryption oracle.
Labeled Encryption. In many applications in which one uses a CCA2 secure encryption scheme, the notion of a label is very useful. Very briefly, a label consists
of public data which is non-malleably attached to a ciphertext. In effect, it allows the encryptor to control the context in which a ciphertext is decrypted. This
notion has been around for a long time, under various names, e.g., “indicator”,
“tag”, “header”, “associated data” [28,38,37,12,29,26,32]. While one can always
implement the label mechanism by appending the label to the plaintext, this is
often not the most practical way to achieve this.
Coming back to the key-wrap problem, a label may be used to describe the
type of message being encrypted: if it encrypts a key, who the key belongs to, etc.
When the hardware token decrypts a ciphertext labeled as a key, it can restrict
the usage of the decrypted key; in particular, the token can ensure that such a
key is only used within the token in appropriate ways (e.g., decryption, further
key-wrap). Even if a token restricts the usage in this way, an adversary may
attempt a chosen ciphertext attack by submitting an encryption of a key that
actually belongs to Alice, and make it look like it belongs to Bob; moreover,
perhaps the adversary is authorized to decrypt ciphertexts under Bob’s key,
which in effect allows him to decrypt ciphertexts encrypted under Alice’s key.
However, if labels are used as described above, CCA2 security will prevent such
attacks from succeeding.
Because of their utility, we include labels in our definition of KDM-CCA2 security, and implement them in our construction. Moreover, we exploit the label mechanism for plain CCA2 encryption in our general construction to bind together the
two ciphertexts and NIZK proof of the Naor-Yung paradigm. In particular, we shall
see that the CCA2 encryption scheme we use directly support labels in a way that
interacts very nicely with pairing-based NIZK techniques, leading to a conceptually simple and quite efficient concrete instantiation of our general construction.
Another use of labels is to enlarge the message space of a CCA2 encryption
scheme: to encrypt a sequence of messages as a package, one can generate a
key pair for a strongly secure one-time signature scheme, and then encrypt each
message in the sequence using the verification key as a label, and then signing
the whole sequence of ciphertexts. This application is convenient for us, because
the BHHO scheme can only encrypt one bit of a secret key at a time.
354
J. Camenisch, N. Chandran, and V. Shoup
Other related work. Backes, Pfitzmann and Scedrov [2] and Backes, Dürmuth
and Unruh [1] considered KDM-CCA2 security of symmetric and asymmetric
encryption schemes, respectively. They in fact define a notion of security stronger
than we consider in our paper, by allowing the adversary to obtain some of the
secret keys. They showed that RSA-OAEP ([4]) is secure in this sense in the
random oracle model.
Halevi and Krawczyk [22] studied key-dependent message security (under the
name key-dependent input (KDI) security) with respect to primitives such as
pseudo-random functions (PRFs) and block ciphers. They showed that in the idealcipher model, KDI secure PRFs can be built if one restricts the functions of the key
to be independent of the ideal-cipher. Further, they showed that this goal cannot
be achieved in the standard model. On the positive side, they show that if one allows the PRF construction to depend on a fixed public value, but does not allow
the function of the key to depend on this value, then KDI secure PRFs can be constructed in the standard model. Hofheinz and Unruh [24], constructed a symmetric
key encryption scheme that achieves KDM-CPA security when an adversary can
only make a bounded number of encryptions. Haitner and Holenstein [21] proved
negative results for KDM-CPA security of encryption schemes when an adversary
can query encryptions of specific functions of the secret key.
Outline of the paper. In §2, we give and discuss the definitions of KDM-CCA2,
NIZK proofs, and strong one-time signatures, i.e., the ingredients of our generic
construction, which is presented in §3.
In §4, we present concrete instantiations of our building blocks: We recall
the BHHO KDM-CPA encryption scheme, the K-linear version of the CramerShoup CCA2 encryption scheme, and Groth’s strongly secure one-time signature
scheme. As a service to the reader, we give a self-contained exposition of a simplified version of the NIZK proof system of Groth and Sahai [20] as it applies to
linear equations over a group. This allows us to completely describe the instantiation of our construction and analyze its complexity.
In the full version of the paper [10], we discuss an alternative construction
of KDM-CCA2 encryption that uses a CPA secure encryption scheme instead
of a CCA2 secure encryption scheme but requires an NIZK proof system that
provides (unbounded) simulation soundness [34,35]. In the full paper, we also
show how to make the general NIZK proofs of [20] (unbounded) simulation
sound, given a CCA2 secure encryption scheme that supports ciphertexts with
labels, which again illustrates the power labels.
2
2.1
Preliminaries
Notation
When we say that an algorithm is efficient, we mean that the algorithm runs
in probabilistic polynomial time in the security parameter. All our algorithms
and functions take as input an implicit security parameter. When we say that
a function is negligible, we mean that it is negligible in the implicit security
parameter. Let ab denote the concatenation of string a with string b.
A Public Key Encryption Scheme Secure against Key Dependent
2.2
355
Definition of KDM-CCA2 Security
Let E be a public key encryption system that supports ciphertexts with labels, which consists of three (probabilistic) efficient algorithms EncKeyGen, E
and D. EncKeyGen is a randomized key generation algorithm, that outputs a
public key/secret key pair (pk , sk ). The algorithm E takes as input a message
m (from the message space M), a public key pk and a label ℓ, and outputs a
ciphertext c := E(pk , m, ℓ). When we need to explicitly refer to the randomness in the encryption, we shall refer to an encryption of a message m with
randomness r by E(pk , m, ℓ; r). The decryption algorithm D takes as input a
secret key sk , a ciphertext c, and a label ℓ, and either outputs a message m
or reject. The (perfect) correctness condition is that (with probability one)
D(sk , E(pk , m, ℓ), ℓ) = m for all messages m, labels ℓ and (pk , sk ) pairs output
by EncKeyGen.
When we use a public key encryption scheme E that does not support labels, we refer to the encryption and decryption algorithms of such a scheme by
E(pk, m) and D(sk, c), respectively.
We extend the definition of key dependent message security from Black et
al. [5] to the notion of security against chosen ciphertext attack ([30,31,15]).
We will note that the standard definitions of public key encryption security are
specific instances of this definition.
Let S denote the space of secret keys output by EncKeyGen. As in [22] and [9],
key-dependence is defined with respect to a fixed set of functions C. Let n > 0
be an integer and let C be a finite set of functions C := {f : S n → M}. KDMsecurity is defined with respect to C through the following two experiments
between a challenger and an adversary A. Let d ∈ M be a fixed (dummy)
message in M. Experiment b (where b = 0, 1) is defined as follows:
1. Initialization phase: In both experiments the challenger runs EncKeyGen()
n times and obtains n key pairs (pk 1 , sk 1 ), (pk 2 , sk 2 ), · · · , (pk n , sk n ). It sends
the vector (pk 1 , pk 2 , · · · , pk n ) to A.
2. Query phase: In both experiments, A may adaptively make the following
two types of queries to the challenger.
(a) Encryption queries: A can make a query of the form (i, f, ℓ), where
1 ≤ i ≤ n, f ∈ C and ℓ is a label. The challenger responds by setting
m := f (sk 1 , sk 2 , · · · , sk n ) ∈ M.
In Experiment b = 0, it sets c := E(pk i , m, ℓ).
In Experiment b = 1, it sets c := E(pk i , d, ℓ).
In both experiments, the challenger sends c to A.
When the adversary A submits (i, f, ℓ) as an encryption query and the
response of the challenger is c, we call (i, c, ℓ) a target tuple.
(b) Decryption queries: In both experiments, A can make a query of the
form (i, c, ℓ), where 1 ≤ i ≤ n, c is a string to be decrypted using secret
key sk i and ℓ is a label. The only restriction is that (i, c, ℓ) cannot be
a (previous) target tuple. Note that c might not necessarily be a valid
356
J. Camenisch, N. Chandran, and V. Shoup
ciphertext. That is, c might not be an output of E(pk j , m, ℓ) for some
1 ≤ j ≤ n, m ∈ M and ℓ.
In both experiments, the challenger responds with D(sk i , c, ℓ).
3. Final phase: Finally, the adversary outputs a bit b′ ∈ {0, 1}.
Definition 1 (KDM-CCA2). A public
scheme E is KDM
key encryption
CCA2 secure with respect to C if Pr W0 − Pr W1 is negligible for all efficient
adversaries A, where Wb is the event that A outputs b′ = 1 in Experiment b.
Note that the standard security definitions for public key encryption can be
viewed as specific instances of the above general definition.
KDM-CPA: By restricting A from making any decryption queries, we get the
definition of key-dependent message semantic security (KDM-CPA) as defined in [9].
CCA2: When we restrict the set of functions C from which A can draw f to
the set of all constant functions on S n → M, we get the experiment for
multiple message, multiple key CCA2 security, which is equivalent to the
standard CCA2 security for a single message and single key (see [3]). If
we further restrict A from making any decryption queries, we obtain the
standard definition for semantic security (also see [3]).
Also note that, unlike regular CPA and CCA2 security, for both KDM-CPA and
KDM-CCA2 security, one cannot reduce the attack game to a single encryption
query and a single key pair.
We note that the definition of security by Backes et al. [1] is somewhat stronger
in that it allows the adversary to obtain some secret keys. To benefit from this in
practice, the users need to carefully keep track of which keys were compromised,
and which keys are related to each other via key-wrap. In contrast, our definition
pessimistically assumes that if one key is compromised then all potentially related
keys should be considered compromised as well—which is probably more realistic.
2.3
Non-interactive Zero-Knowledge Proofs
Let R be a binary relation that is efficiently computable. For pairs of the form
(x, w) ∈ R, x is referred to as the statement and w as the witness. Let L := {x :
(x, w) ∈ R for some w}.
A non-interactive proof system for R consists of the following efficient algorithms: a common reference string (CRS) generation algorithm CRSGen, a prover
P, and a verifier V. The CRSGen algorithm outputs the CRS denoted by C. P
takes as input C, statement x, and witness w. It produces a proof p if (x, w) ∈ R
and outputs failure otherwise. V takes as input C, x, and p. V outputs accept
if it accepts the proof and reject otherwise.
Definition 2 (NIZK[7,16]). (CRSGen, P, V) is a non-interactive zeroknowledge (NIZK) proof system for R if it has the following properties described
below:
A Public Key Encryption Scheme Secure against Key Dependent
357
Perfect Completeness: For all C output by CRSGen(), for all (x, w) ∈ R, and
for all p := P(C, x, w), Pr[V(C, x, p) outputs reject] = 0.
Computational Soundness: Consider the following game:
1. CRSGen() is run to obtain C, which is given to the adversary A.
2. A responds with (x, p).
A wins the game if V(C, x, p) = accept and x ∈
/ L. Let W be the event that A
wins the game. Then, for all efficient adversaries A, we have Pr[W ] is negligible.
Computational Zero-knowledge: Let S := (S1 , S2 ) be a simulator running in polynomial time. Consider the following two experiments:
Experiment 0: CRSGen() is run and the output C is given to A. A is then
given oracle access to P(C, ·, ·).
Experiment 1: S1 () generates C and trapdoor t. A is given C, and is then given
oracle access to S′ (C, t, ·, ·), where S′ (C, t, x, w) is defined to be S2 (C, t, x) if
(x, w) ∈ R and failure if (x, w) ∈
/ R.
Let Wi be the event that A outputs 1 in Experiment i, for i = 0 or 1. Then, for
all efficient adversaries A, we have Pr[W0 ] − Pr[W1 ] is negligible.
Note that Blum et al. [7] give a weaker, “one time” definition of computational
zero-knowledge, in which the adversary is allowed to see only one fake proof.
However, because we cannot reduce KDM-security to an attack game with a
single encryption query, this is insufficient for our purposes.
2.4
Strongly Secure One-Time Signatures
We also require a strongly secure one-time signature scheme. This is a signature
scheme that satisfies the following security property: after obtaining the verification key and a signature s on any message m of its choice, it is infeasible for
an efficient adversary to generate any valid signature s∗ on any message m∗ with
(s∗ , m∗ ) = (s, m). See [10] for a more formal definition.
3
Generic Construction of a KDM-CCA2 Secure Scheme
In this section, we give a generic construction of KDM-CCA2 secure public
key encryption scheme E with respect to a set of functions C. We require the
following building blocks: a public key encryption scheme Ekdm that is KDMCPA secure with respect to the set of functions C; a regular CCA2 secure public
key encryption scheme Ecca that supports ciphertexts with labels; an NIZK proof
system P for the language Leq consisting of the set of all pairs of ciphertexts that
encrypt the same message using Ekdm and Ecca ; and a strongly secure one-time
signature scheme S.
358
J. Camenisch, N. Chandran, and V. Shoup
At a high level, E is similar to the construction of [30,15]. To encrypt a message
m, we generate a key-pair for the scheme S, encrypt m using both Ekdm and Ecca ,
where the label for Ecca will contain the verification key generated above (along
with any input label). Using P, we give a proof that both ciphertexts contain
the same plaintext. We then sign the two ciphertexts as well as the proof using
S. The final ciphertext consists of the verification key, the two ciphertexts, the
proof, and the signature.
3.1
Construction
We now formally describe the scheme E := (EncKeyGen, E, D) in detail. Let
Ekdm := (EncKeyGenkdm , Ekdm , Dkdm ) (with key pair (pk kdm , sk kdm )) and let
Ecca := (EncKeyGencca , Ecca , Dcca ) (with key pair (pk cca , sk cca )). Let S :=
(SignKeyGen, Sign, Verify). Let Leq be the set of all triples (c1 , c2 , ℓ) such that
∃ m, r1 , r2 : c1 = Ekdm (pkkdm , m; r1 ) ∧ c2 = Ecca (pkcca , m, ℓ; r2 ).
Let P := (CRSGen, P, V) be an NIZK proof system for Leq . Note that there
maybe be common system parameters that are used to define Ekdm , Ecca , and
P, and these are input to all associated algorithms. The encryption scheme E
comprises of the following three algorithms.
EncKeyGen():
1. Run EncKeyGenkdm () and EncKeyGencca () to obtain key pairs
(pk kdm , sk kdm ) and (pk cca , sk cca ), respectively.
2. Run CRSGen() to generate the CRS C of the NIZK proof system P.
The public key is pk := (pk kdm , pk cca , C). The secret key is sk := sk kdm .
E(pk , m, ℓ):
1. Let ckdm := Ekdm (pk kdm , m; rkdm ).
2. Run SignKeyGen() to generate key pair (VK ots , SK ots ).
3. Let ccca := Ecca (pk cca , m, ℓVK ots ; rcca ).
4. Let p be the NIZK proof (using P) for (ckdm , ccca , ℓVK ots ) ∈ Leq .
5. Let c′ := ckdm ccca p and let s := SignSK ots (c′ ).
Then E(pk , m, ℓ) := ckdm cccapVK ots s.
D(sk , c, ℓ): Parse c as ckdm ccca pVK ots s (and output reject if this
fails). Output reject if either VerifyVK ots (ckdm ccca p, s) = reject or
V(C, (ckdm , ccca , ℓVK ots ), p) = reject; otherwise, output Dkdm (sk , ckdm ).
The (perfect) correctness of the public key encryption scheme E trivially follows from the (perfect) correctness of the scheme Ekdm , (perfect) completeness
of the proof system P, and the (perfect) correctness of the signature scheme S.
3.2
Proof of Security
Theorem 1. Let Ekdm be a KDM-CPA secure scheme with respect to the set of
functions C. Let Ecca be a CCA2 secure scheme, S a strong one-time signature
scheme, and P an NIZK proof system for Leq . Then E, as constructed above, is
a KDM-CCA2 secure scheme with respect to C.
A Public Key Encryption Scheme Secure against Key Dependent
359
Proof. The proof is through a sequence of games. We first present a schematic
description of the sequence of games used to prove that E is KDM-CCA2 secure.
The underlined parts indicate what has changed in each game.
Game Process encrypt query Process decrypt query
0 enc. (m, m); real p
dec. ckdm
1 enc. (m, m); real p
dec. ccca
dec. ccca
2 enc. (m, m); fake p
3 enc. (m, m); fake p
dec. ccca ; special reject
4 enc. (m, d); fake p
dec. ccca ; special reject
dec. ccca ; no special reject
5 enc. (m, d); fake p
6 enc. (d, d); fake p
dec. ccca
dec. ccca
7 enc. (d, d); real p
8 enc. (d, d); real p
dec. ckdm
justification
soundness for P
ZK for P
strong one-time sig. S
CCA2 for Ecca
strong one-time sig. S
KDM-CPA for Ekdm
ZK for P
soundness for P
The sequence of games involving the challenger Ch and adversary A are more
formally described below. Let Wi be the event that A outputs 1 in Game i.
Game 0: This is the actual attack game, i.e., Experiment 0 in Definition 1.
When responding to an encryption query, Ch encrypts the actual message
m using both encryption schemes. The label for Ecca additionally contains
VK ots which Ch picks using SignKeyGen(). Ch gives a real proof p that both
encryptions contain the same message. It produces the signature s using
SK ots .
Game 1: This game is exactly like Game 0, except that when responding to
a decryption query, Ch decrypts using secret key sk cca instead of sk kdm . It
follows from the soundness of the proof system P that Pr[W1 ] − Pr[W0 ] is
negligible.
Game 2: This game is exactly like Game 1, except that when responding to
an encryption query, Ch gives a simulated proof p (using the trapdoor of
the proof system) instead
of a real proof.
It follows from the zero-knowledge
property of P that Pr[W2 ] − Pr[W1 ] is negligible.
Game 3: This game is exactly like Game 2, except that when responding to a decryption query of the form (i, c, ℓ) from A such that c =
ckdm ccca pVK ots s, Ch first checks if there exists a target tuple of the
form (i, c∗ , ℓ), with c∗ = c∗kdm ccca p∗ VK ots s∗ for some c∗kdm , p∗ and s∗ . If
this is the case, then let c∗ be the first such response by Ch. Now if c∗ = c,
then Ch rejects the encryption query. We call this the special rejection rule.
It follows from the strong one-time security of the signature scheme S that
Ch rejects
via the special
rejection rule only with negligible probability and
hence Pr[W3 ] − Pr[W2 ] is negligible.
In Game 3, Ch never decrypts a ciphertext that was contained in a target tuple
using skcca . We can therefore make use of the CCA2 security of Ecca .
Game 4: This game is exactly like Game 3, except that when responding to
an encryption query, Ch encrypts the dummy message d using Ecca but still
encrypts the actual message musing Ekdm . It follows from the CCA2 security
of Ecca that Pr[W4 ] − Pr[W3 ] is negligible.
360
J. Camenisch, N. Chandran, and V. Shoup
Game 5: This game is exactly like Game 4, except that when responding to a
decryption query, Ch no longer follows the special rejection rule that was defined in Game 3. It follows from the
strong one-time security of the signature
scheme S, that Pr[W5 ] − Pr[W4 ] is negligible.
Game 6: This game is exactly like Game 5, except that when responding to an
encryption query, Ch encrypts the dummy message d using both encryption
schemes.
It follows from the KDM-CPA security of Ekdm that Pr[W6 ] −
Pr[W5 ] is negligible.
Game 7: This game is exactly like Game 6, except that when responding to
an encryption query, Ch gives a real proof p that both encryptions contain
the
same message.
It follows from the zero-knowledge property of P that
Pr[W7 ] − Pr[W6 ] is negligible.
Game 8: This game is exactly like Game 7, except that when responding to
a decryption query, Ch decrypts using secret key sk kdm instead of sk cca . It
follows from the soundness of the proof system P that Pr[W8 ] − Pr[W7 ] is
negligible. Game 8 is Experiment 1 in Definition 1.
Combining the different games, we get that Pr[W8 ]−Pr[W0 ] is negligible, which
proves Theorem 1. A more detailed proof can be found in [10].
Note that we used the computational soundness property of the proof system P
only in Games 1 and 8 and in both these games, Ch only gave real proofs for
true statements. Hence “plain” soundness of P is sufficient and we do not require
the proof system to be simulation sound ([34]). In the definition of KDM-CCA2
security, one cannot reduce the attack game to a single encryption query and a
single public key. Therefore, one-time zero-knowledge (see remark after Definition 2) would not be sufficient for our proof (one-time zero-knowledge does not
imply multi-proof zero-knowledge). However, note that CCA2 security is sufficient, as the “single instance” definition implies the “multi-instance” definition
(see remark after Definition 1).
4
Specific Number-Theoretic Instantiation of a
KDM-CCA2 Secure Scheme
In this section, we give specific efficient instantiations of the building blocks
used to construct the generic scheme presented in §3. We introduce notation
and the number-theoretic assumptions in §4.1. In §4.2, we describe the KDMCPA scheme of Boneh et al. [9], while in §4.3, we describe the K-linear version
of the Cramer-Shoup CCA2 encryption scheme that we need. In §4.4 and §4.5,
we describe the NIZK proof system used to prove equality of plaintexts. We use
the efficient strongly one-time signature scheme of Groth [18] (which we describe
in §4.6), to complete our instantiation of a KDM-CCA2 secure scheme. In §4.7,
we discuss the size of the public key, system parameters, and ciphertext of our
encryption scheme.
A Public Key Encryption Scheme Secure against Key Dependent
4.1
361
General Notation and Assumptions
Let G be a group of prime order q. We shall write G using multiplicative notation.
One naturally views G as a vector space over Zq , where for x ∈ Zq and g ∈ G,
the “scalar product” of x and g is really the power gx . Because of this, we shall
often employ concepts and terminology from linear algebra.
For vectors g := (g1 , . . . , gR ) ∈ GR and x := (x1 , . . . , xR ) ∈ ZR
q , define
K
x1
xR
R
g, x := g1 . · · · . gR ∈ G. When we write i=1 gi ∈ G for vectors gi ∈ GR ,
we mean the component wise product of each of the R terms. Unless otherwise
specified, there is no a priori relation between g, g, gi and gi .
Definition 3 (K-linear assumption [36,27]). Let G be a group of prime
order q. For a constant K ≥ 1, the K-linear assumption in G is defined through
the following two experiments (0 and 1) between a challenger and an adversary
A that outputs 0 or 1.
Experiment 0: The challenger picks K + 1 random generatorsof G:
K
g1 , g2 , . . . , gK+1 , picks random x1 , . . . , xK ∈ Zq and sets xK+1 = i=1 xi .
xK+1
x1
x2
A is given (g1 , g2 , . . . , gK+1 , g1 , g2 , . . . , gK+1 ) as input.
Experiment 1: The challenger picks K + 1 random generators of G:
g1 , g2 , . . . , gK+1 and picks random x1 , x2 , . . . , xK+1 ∈ Zq . A is given
xK+1
(g1 , g2 , . . . , gK+1 , g1x1 , g2x2 , . . . , gK+1
) as input.
The
assumption holds in G if for all efficient adversaries A, Pr W0 −
K-linear
Pr W1 is negligible, where Wi is the event that A outputs 1 in Experiment i.
Another way to understand the K-linear assumption is as follows. Let us define group vectors g1 , . . . , gK ∈ GK+1 : g1 := (g1 , 1, 1, . . . , 1, gK+1 ), g2 :=
(1, g2 , 1, . . . , 1, gK+1 ), . . . , gK := (1, 1, . . . , 1, gK , gK+1 ). Let T denote the subspace of GK+1 generated by g1 , . . . , gK . The K-linear assumption says that it
is hard to distinguish random elements of T from random elements of GK+1 .
Note that the standard Decisional Diffie-Hellman (DDH) assumption is the 1linear assumption and the linear assumption (introduced in [8]) is the 2-linear
assumption.
Pairings. Let G, Γ and GT be groups of prime order q. We shall use Roman
letters to denote elements in G and Greek letters to denote elements in Γ . A
pairing is a map e : G × Γ → GT that satisfies the following properties: (1) e is
bilinear, which means that for all a ∈ G and α ∈ Γ , the maps e(a, ·) : Γ → GT
and e(·, α) : G → GT are linear maps; (2) e is non-degenerate, which means that
its image is not {1}; and (3) e is efficiently computable.
4.2
KDM-CPA Secure Scheme Based on the K-Linear Assumption
In this section, we describe the public key encryption scheme of Boneh et
al. [9] based on the K-linear assumption. Let N := ⌈(K + 2) log2 q⌉. Ekdm =
(EncKeyGenkdm , Ekdm , Dkdm ) is as described below. The message space of this
scheme is the group G.
362
J. Camenisch, N. Chandran, and V. Shoup
EncKeyGenkdm :
1. Pick random g1 , . . . , gK ∈ GN .
2. Pick random s ∈ {0, 1}N .
3. Define hi := gi , s ∈ G for i = 1, . . . , K.
4. Output the secret key sk kdm := s and the public key
pk kdm := (g1 , . . . , gK , h1 , . . . , hK ).
Ekdm (pk kdm , m):
1. Pick random r1 , . . . , rK ∈ Zq .
K
K
2. Output the ciphertext (g, h) :=
giri , m · i=1 hri i ∈ GN × G.
i=1
Dkdm (sk kdm , (g, h)): Output m := h/ g, s .
Note that the ith bit si of the secret key s is encoded for the purpose of
encryption as gsi for some random (but fixed) g ∈ G.
The key space (of encoded secret keys) is GN . Define a function ft,b : GnN →
and b ∈ G to be the map ft,b (u) := u, t · b. Let C be the
G for fixed t ∈ ZnN
q
set of all functions ft,b for all values of t ∈ ZnN
and b ∈ G. Ekdm is KDM-CPA
q
secure with respect to the set of functions C [9].
Note that [9] explicitly describes the above scheme in the case K = 1, and
only briefly mentions its generalization to K > 1 (the explicit description of
which has been obtained from the authors of [9] via personal communication).
4.3
CCA2 Secure Scheme Based on the K-Linear Assumption
In this section, we describe a generalized version of the Cramer-Shoup encryption
scheme based on the K-linear assumption. This generalization was described
in [23] and [36]. However, given the K-linear decision problem, this scheme is
essentially already implicit in [14] (based on Theorems 2 and 3, along with
Example 1 in §7.4, of the full length version of that paper). This scheme is CCA2
secure and supports ciphertexts with labels. Ecca = (EncKeyGencca , Ecca , Dcca )
is as described below. The message space of this scheme is the group G, and the
label space is {0, 1}∗.
EncKeyGencca :
1. Pick random f1 , . . . , fK+1 ∈ G.
2. Pick random x, y, z ∈ ZK+1
.
q
3. Define the following elements of GK+1 : f1 := (f1 , 1, 1, . . . , 1, fK+1 ) , f2 :=
(1, f2 , 1, . . . , 1, fK+1 ) , . . . , fK := (1, 1, . . . , 1, fK , fK+1 ).
4. Define the following elements of G: ci := fi , x , di := fi , y , ei :=
fi , z (i = 1, . . . , K).
5. Output
the secret key sk cca := (x, y , z ) and the public key pk cca :=
K
K
K
{fj }K+1
j=1 , {ci }i=1 , {di }i=1 , {ei }i=1 .
Ecca (pk cca , m, ℓ):
1. Pick random w1 , . . . , wK ∈ Zq .
A Public Key Encryption Scheme Secure against Key Dependent
363
K wi
K wi K
t wi
∈ GK+1 ×
2. Compute (f , a, b) :=
i=1 (di ei )
i=1 fi , m· i=1 ci ,
G × G, where t := H(f , a, ℓ) ∈ Zq and H is a collision resistant hash
function. Output the ciphertext is (f , a, b).
Dcca (sk cca , (f , a, b), ℓ):
1. Verify that b = f , y + tz .
2. Output m := a/ f , x .
Note that the schemes in [14,36,23] do not explicitly support labels; however,
the proof of security immediately generalizes to allow this, provided one assumes
(as we do) that H is collision resistant.
4.4
NIZK Proofs for Satisfiable Systems of Linear Equations over
Groups
In this section, we describe the NIZK proofs for proving that a system of linear
equations over a group is satisfiable. These proofs are derived from Groth and
Sahai [20]. The paper [20] deals with much more general systems of equations; for
many applications, such as ours, we only need linear equations. For completeness,
and concreteness, we describe how the methods of [20] apply to this setting. Our
exposition is self contained, but brief.
Let G be a group
W ofX prime order q. A linear equation over G is an equation of
the form g0 = j=1 gj j , where g0 , g1 , . . . , gW ∈ G are constants and X1 , . . . , XW
are variables. An assignment to the variables is a tuple (x1 , . . . , xW ) ∈ ZW
q , and
W xj
such an assignment satisfies the equation if g0 = j=1 gj . A set S of linear
equations over G is called satisfiable if there exists an assignment to the variables
that simultaneously satisfies each equation in S.
Let Llsat be the language of all satisfiable sets of linear equations over G.
A witness for membership in Llsat is a satisfying assignment. Our goal is to
construct an efficient NIZK proof system for Llsat .
Our proof system for Llsat requires a pairing e : G×Γ → GT , where Γ and GT
are also groups of order q. In addition, we need to make the L-linear assumption
in Γ , for some constant L (typically, L is a small constant like 1 or 2, depending
on the assumption we make).
– The CRS generator works as follows:
1. Pick random γ1 , . . . , γL+1 ∈ Γ .
2. Define the following elements of Γ L+1 : γ1 := (γ1 , 1, . . . , 1, γL+1 ), γ2 :=
(1, γ2 , . . . , 1, γL+1 ), . . . , γL := (1, 1, . . . , γL , γL+1 ).
3. Choose γ ∈ Γ L+1 at random.
4. The common reference string is (γ1 , . . . , γL+1 , γ ).
– Given a set S of equations, along with a satisfying assignment (x1 , . . . , xW ),
the prover works as follows:
L
r
1. Commit to x1 , . . . , xW by setting δj := γ xj k=1 γk jk , for j = 1, . . . , W ,
where the rjk ’s are randomly chosen elements of Zq .
364
J. Camenisch, N. Chandran, and V. Shoup
2. The proof consists of thecommitments δ1 , . . . , δW , and, in addition,
Xj
W
for each equation g0 =
j=1 gj in S, the proof contains L corresponding
elements” p1 , . . . , pL ∈ G, which are computed as:
“proof
rjk
(k = 1, . . . , L).
pk := W
j=1 gj
– To verify such a proof,
the verifier takes the commitments δ1 , . . . , δW , and,
X
W
for each equation g0 = j=1 gj j in S, takes the corresponding proof elements
p1 , . . . , pL , and checks that
L
W
E(gj , δj ) = E(g0 , γ )
j=1
E(pk , γk ).
(1)
k=1
is the biliear map that sends (g, (α1 , . . . , αL+1 ))
Here, E : G×Γ L+1 → GL+1
T
to (e(g, α1 ), . . . , e(g, αL+1 )).
The CRS contains 2(L + 1) elements of Γ , and a proof consists of W (L + 1) elements of Γ (for the commitments) and |S|L elements of G (for the proof elements).
We now show that the above proof system has perfect completeness, (statistical) soundness, and computational zero-knowledge.
Perfect completeness. To argue perfect completeness, using bilinearity, one
checks by a simple calculation that for any satisfying assignment (x1 , . . . , xW ),
and for any choice of the rjk ’s, equation (1) will always be satisfied.
Soundness. A simple fact that will be useful in proving both the soundness and
zero-knowledge property is the following, which the reader can easily verify using
bilinearity:
R ∈ Γ L+1 are linearly independent, then the map
Lemma 1. If β1 , . . . , β
1 ) · · · E(hR , β
R )
(h1 , . . . , hR ) → E(h1 , β
is an injective linear map from GR into GL+1
T .
To prove soundness, note that with overwhelming probability, the vectors
γ , γ1 , . . . , γL form a basis for Γ L+1 . Suppose a proof contains commitments
δ1 , . . . , δW ∈ Γ L+1 . Regardless of how these commitments were actually comL
r
puted, each δj can be expressed uniquely as δj = γ xj k=1 γk jk for some
W Xj
xj , rj1 , . . . , rjL ∈ Zq . Now consider any particular equation g0∗ =
gj ,
W j=1
xj
∗
∗
and
and corresponding proof elements p1 , . . . , pL . Define g0 :=
j=1 gj
W rjk
for k = 1, . . . , L, using the xj ’s and rjk ’s determined
pk :=
j=1 gj
as above
by
the
commitments.
Onthe one hand, by perfect completeness, we
W
L
have j=1 E(gj , δj ) = E(g0 , γ ) k=1 E(pk , γk ). On the other hand, if the
verification equation (1) holds for the given equation and proof elements, then
L
W
we also must have j=1 E(gj , δj ) = E(g0∗ , γ ) k=1 E(p∗k , γk ). Thus, we have
L
L
E(g0 , γ ) k=1 E(pk , γk ) = E(g0∗ , γ ) k=1 E(p∗k , γk ). Applying Lemma 1 to the
linearly independent vectors γ , γ1 , . . . , γL , we conclude that g0 = g0∗ (and in fact,
pk = p∗k for k = 1, . . . , L). It follows that if the proof verifies, then the assignment
x1 , . . . , xW determined by the commitments simultaneously satisfies all the given
equations.
A Public Key Encryption Scheme Secure against Key Dependent
365
Zero Knowledge. The simulator generates a“fake CRS” as follows: it geners
L
ates γ1 , . . . , γL as usual, but it computes γ as k=1 γj j for random s1 , . . . , sL ∈
Zq . The trapdoor for the fake CRS is (s1 , . . . , sL ).
In a fake CRS, γ1 , . . . , γL are linearly independent (with overwhelming probability), while γ is a random element of the subspace V generated by γ1 , . . . , γL .
To simulate a proof for
set S of linear equations, the simulator
La satisfiable
r
starts by setting δj := k=1 γk jk for random rjk ∈ Zq for j = 1, . . . , W and
W X
k = 1, . . . , L. For each equation g0 = j=1 gj j in S, the simulator generates
W r
proof elements p1 , . . . , pL as follows: pk := g0−sk j=1 gj jk (k = 1, . . . , L).
The reader may easily verify, using the bilinearity property, that the verification
equation (1) is satisfied.
We now argue that fake proofs are computationally indistinguishable from
real proofs. To this end, let us introduce a hybrid prover, which works exactly like a real prover, except that it uses a fake CRS. Such hybrid proofs
are computationally indistinguishable from real proofs, under the L-linear assumption for Γ . Moreover, hybrid proofs are statistically indistinguishable from
fake proofs. To see this, observe that with overwhelming probability, γ1 , . . . , γL
are linearly independent. Assuming this is true, in both the hybrid and fake
proofs, the distribution of the commitments are the same (uniformly and independently distributed over the subspace V ). Additionally, in both types of
proofs, the proof elements p1 , . . . , pL for a given equation are uniquely determined in the same way by the equation, the commitments, and the CRS; indeed,
both types of provers generate proof elements that satisfy the verification equation (1); moreover, applying Lemma 1 to the vectors γ1 , . . . , γL , we see that for
a fixed equation, commitments, and CRS, there exist unique p1 , . . . , pL that
satisfy (1).
4.5
NIZK Proof for Proving Equality of Plaintext
Given a ciphertext of Ekdm (from §4.2) of the form (g, h) ∈ GN × G and a
ciphertext of Ecca (from §4.3) of the form (f , a, b) ∈ GK+1 × G × G with respect
to a label ℓ ∈ {0, 1}∗, we want to prove that they are valid encryptions of the
same message. This is
by proving
that there existr1 , . . . , rK , w1 , . . . , wK ∈
K
done
K
K
Zq such that g = i=1 giri , f = i=1 fiwi , b = i=1 (di eti )wi , and h/a =
K ri K wi
i=1 ci , where t := H(f , a, ℓ).
i=1 hi /
This translates into N +(K +1)+1+1 = N +K +3 equations in 2K variables.
Using the proof system above, this means we need (2K)(L + 1) elements of Γ
for commitments, and (N + K + 3)L elements of G for the proofs.
4.6
Strongly Secure One-Time Signature Scheme
Here is the strongly secure one-time signature scheme S from Groth [18]. It
makes use of a group G of prime order q with generator g, and a hash function
H : {0, 1}∗ → Zq . The scheme is secure assuming the hardness of computing
discrete logs in G (which follows from the K-linear assumption) and assuming
H is collision resistant.
366
J. Camenisch, N. Chandran, and V. Shoup
SignKeyGen: Pick random x, y ∈ Z∗q and r, s ∈ Zq , and set f := gx , h := gy ,
and c := f r hs . The verification key is VK = (f , h, c) and the secret key
SK = (x, y, r, s).
SignSK (m): To sign a message m ∈ {0, 1}∗, pick t at random from Zq . The
signature is s = (t, (x(r − t) + ys − H(m))/y).
VerifyVK (m, s): To verify the signature s = (t, w), check that c = gH(m) f t hw .
4.7
Size of Public Key, System Parameters and Ciphertext
Using the K-linear assumption for G and the L-linear assumption for Γ , the
size of the public key, system parameters and ciphertext are as follows, where
N := ⌈(K + 2) log2 q⌉.
The system parameters consists of the CRS which comprises 2(L+1) elements
of Γ , the descriptions of G, Γ, GT , e and the collision resistant hash function H
for Ecca and S.
The public key of E consists of (N + 1)K elements of G for the public key
pk kdm and 4K+1 elements of G for the public key pk cca , for a total of (N +5)K+1
elements of G.
The two ciphertexts (ckdm and ccca ) require (N + 1) and (K + 3) elements of
G, respectively, giving a total of N + K + 4 elements of G. To prove equality of
plaintexts, we require (2K)(L + 1) elements of Γ for commitments, and (N +
K + 3)L elements of G for the proofs. Finally, to sign the resulting ciphertexts
and proofs using the one-time signature scheme S, we require 3 elements of G
for the verification key VK of S and 2 elements of Zq for the signature.
Note that we can make the public key shorter, by making pk cca as part of
the system parameters; indeed, since the secret key sk cca is not needed (other
than in the proof of security), one can simply generate all of the group elements
appearing in pk cca at random (yielding a distribution that is statistically close
to the real distribution on public keys).
We emphasize that, typically, one would set K = 1, 2 and L = 1, 2, depending
on the groups G and Γ . For example, at one extreme, if G = Γ , then one could
set K = L = 2; at the other extreme, if G = Γ , and there is no (known)
efficiently computable homomorphism from G to Γ or vice versa, then one could
set K = L = 1.
References
1. Backes, M., Dürmuth, M., Unruh, D.: OAEP is secure under key-dependent messages. In: Pieprzyk, J. (ed.) ASIACRYPT 2008. LNCS, vol. 5350, pp. 506–523.
Springer, Heidelberg (2008)
2. Backes, M., Pfitzmann, B., Scedrov, A.: Key-dependent message security under
active attacks - BRSIM/UC-soundness of symbolic encryption with key cycles. In:
CSF, pp. 112–124 (2007)
3. Bellare, M., Boldyreva, A., Micali, S.: Public-key encryption in a multi-user setting: Security proofs and improvements. In: Preneel, B. (ed.) EUROCRYPT 2000.
LNCS, vol. 1807, pp. 259–274. Springer, Heidelberg (2000)
A Public Key Encryption Scheme Secure against Key Dependent
367
4. Bellare, M., Rogaway, P.: Optimal asymmetric encryption. In: De Santis, A. (ed.)
EUROCRYPT 1994. LNCS, vol. 950, pp. 92–111. Springer, Heidelberg (1995)
5. Black, J., Rogaway, P., Shrimpton, T.: Encryption-scheme security in the presence
of key-dependent messages. In: Selected Areas in Cryptography, pp. 62–75 (2002)
6. Bleichenbacher, D.: Chosen ciphertext attacks against protocols based on the RSA
encryption standard PKCS #1. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS,
vol. 1462, pp. 1–12. Springer, Heidelberg (1998)
7. Blum, M., Feldman, P., Micali, S.: Non-interactive zero-knowledge and its applications (extended abstract). In: STOC 1988, pp. 103–112 (1988)
8. Boneh, D., Boyen, X., Shacham, H.: Short group signatures. In: Franklin, M. (ed.)
CRYPTO 2004. LNCS, vol. 3152, pp. 41–55. Springer, Heidelberg (2004)
9. Boneh, D., Halevi, S., Hamburg, M., Ostrovsky, R.: Circular-secure encryption from
decision diffie-hellman. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp.
108–125. Springer, Heidelberg (2008)
10. Camenisch, J., Chandran, N., Shoup, V.: A public key encryption scheme secure
against key dependent chosen plaintext and adaptive chosen ciphertext attacks.
Cryptology ePrint Archive, Report 2008/375 (2008), http://eprint.iacr.org/
11. Camenisch, J.L., Lysyanskaya, A.: An efficient system for non-transferable anonymous credentials with optional anonymity revocation. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, vol. 2045, pp. 93–118. Springer, Heidelberg (2001)
12. Camenisch, J.L., Shoup, V.: Practical verifiable encryption and decryption of discrete logarithms. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 126–144.
Springer, Heidelberg (2003)
13. Cramer, R., Shoup, V.: A practical public key cryptosystem provably secure against
adaptive chosen ciphertext attack. In: Krawczyk, H. (ed.) CRYPTO 1998. LNCS,
vol. 1462, pp. 13–25. Springer, Heidelberg (1998)
14. Cramer, R., Shoup, V.: Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption. In: Knudsen, L.R. (ed.)
EUROCRYPT 2002. LNCS, vol. 2332, p. 45. Springer, Heidelberg (2002),
http://eprint.iacr.org/2001/085
15. Dolev, D., Dwork, C., Naor, M.: Non-malleable cryptography (extended abstract).
In: STOC 1991, pp. 542–552 (1991)
16. Feige, U., Lapidot, D., Shamir, A.: Multiple non-interactive zero knowledge proofs
based on a single random string (extended abstract). In: FOCS 1990, pp. 308–317
(1990)
17. Goldwasser, S., Micali, S.: Probabilistic encryption and how to play mental poker
keeping secret all partial information. In: STOC 1982, pp. 365–377 (1982)
18. Groth, J.: Simulation-sound NIZK proofs for a practical language and constant size
group signatures. In: Lai, X., Chen, K. (eds.) ASIACRYPT 2006. LNCS, vol. 4284,
pp. 444–459. Springer, Heidelberg (2006)
19. Groth, J., Ostrovsky, R., Sahai, A.: Perfect non-interactive zero knowledge for NP.
In: Vaudenay, S. (ed.) EUROCRYPT 2006. LNCS, vol. 4004, pp. 339–358. Springer,
Heidelberg (2006)
20. Groth, J., Sahai, A.: Efficient non-interactive proof systems for bilinear groups. In:
Smart, N.P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 415–432. Springer,
Heidelberg (2008)
21. Haitner, I., Holenstein, T.: On the (im)possibility of key dependent encryption. In:
TCC 2009 (2009)
22. Halevi, S., Krawczyk, H.: Security under key-dependent inputs. In: CCS 2007: Proceedings of the 14th ACM conference on Computer and communications security,
pp. 466–475. ACM, New York (2007)
368
J. Camenisch, N. Chandran, and V. Shoup
23. Hofheinz, D., Kiltz, E.: Secure hybrid encryption from weakened key encapsulation.
In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 553–571. Springer,
Heidelberg (2007)
24. Hofheinz, D., Unruh, D.: Towards key-dependent message security in the standard model. In: Smart, N.P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 108–
126. Springer, Heidelberg (2008)
25. IBM. IBM CCA Basic Services Reference and Guide for the IBM 4758 PCI and
IBM 4764 PCI-X Cryptographic Coprocessors: Releases 2.53, 2.54, 3.20, 3.23, 3.24,
3.25, 3.27, and 3.30 (2008)
26. Kiltz, E.: Chosen-ciphertext security from tag-based encryption. In: Halevi, S.,
Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 581–600. Springer, Heidelberg
(2006)
27. Kiltz, E.: Chosen-ciphertext secure key-encapsulation based on gap hashed diffiehellman. In: Okamoto, T., Wang, X. (eds.) PKC 2007. LNCS, vol. 4450, pp. 282–
297. Springer, Heidelberg (2007)
28. Lim, C.H., Lee, P.J.: Another method for attaining security against adaptively
chosen ciphertext attacks. In: Stinson, D.R. (ed.) CRYPTO 1993. LNCS, vol. 773,
pp. 420–434. Springer, Heidelberg (1994)
29. MacKenzie, P.D., Reiter, M.K., Yang, K.: Alternatives to non-malleability: Definitions, constructions, and applications. In: Naor, M. (ed.) TCC 2004. LNCS,
vol. 2951, pp. 171–190. Springer, Heidelberg (2004)
30. Naor, M., Yung, M.: Public-key cryptosystems provably secure against chosen ciphertext attacks. In: STOC 1990, pp. 427–437 (1990)
31. Rackoff, C., Simon, D.R.: Non-interactive zero-knowledge proof of knowledge and
chosen ciphertext attack. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576,
pp. 433–444. Springer, Heidelberg (1992)
32. Rogaway, P., Shrimpton, T.: A provable-security treatment of the key-wrap problem. In: Vaudenay, S. (ed.) EUROCRYPT 2006. LNCS, vol. 4004, pp. 373–390.
Springer, Heidelberg (2006)
33. RSA Laboratories. PKCS #11 v2.20: Cryptographic Token Interface Standard
(2004)
34. Sahai, A.: Non-malleable non-interactive zero knowledge and adaptive chosenciphertext security. In: FOCS 1999, pp. 543–553 (1999)
35. De Santis, A., Di Crescenzo, G., Ostrovsky, R., Persiano, G., Sahai, A.: Robust noninteractive zero knowledge. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139,
pp. 566–598. Springer, Heidelberg (2001)
36. Shacham, H.: A Cramer-Shoup encryption scheme from the linear assumption
and from progressively weaker linear variants. Cryptology ePrint Archive, Report
2007/074 (2007), http://eprint.iacr.org/
37. Shoup, V.: A proposal for an ISO standard for public key encryption, version 2.1
(2001), http://shoup.net/papers/
38. Shoup, V., Gennaro, R.: Securing threshold cryptosystems against chosen ciphertext attack. In: Nyberg, K. (ed.) EUROCRYPT 1998. LNCS, vol. 1403, pp. 1–16.
Springer, Heidelberg (1998)