Journal of Cryptology

, Volume 23, Issue 1, pp 91–120

A New and Improved Paradigm for Hybrid Encryption Secure Against Chosen-Ciphertext Attack


  • Yvo Desmedt
    • Dept. of Computer ScienceUniversity College London
    • IBM T.J. Watson Research Center
  • Kaoru Kurosawa
    • Dept. of Computer and Information SciencesIbaraki University
  • Victor Shoup
    • Computer Science Dept.NYU

DOI: 10.1007/s00145-009-9051-4

Cite this article as:
Desmedt, Y., Gennaro, R., Kurosawa, K. et al. J Cryptol (2010) 23: 91. doi:10.1007/s00145-009-9051-4


We present a new encryption scheme which is secure against adaptive chosen-ciphertext attack (or CCA2-secure) in the standard model (i.e., without the use of random oracle). Our scheme is a hybrid one: it first uses a public-key step (the Key Encapsulation Module or KEM) to encrypt a random key, which is then used to encrypt the actual message using a symmetric encryption algorithm (the Data Encapsulation Module or DEM).

Our scheme is a modification of the hybrid scheme presented by Shoup in (Euro-Crypt’97, Springer LNCS, vol. 1233, pp. 256–266, 1997) (based on the Cramer–Shoup scheme in CRYPTO’98, Springer LNCS, vol. 1462, pp. 13–25, 1998). Its major practical advantage is that it saves the computation of one exponentiation and produces shorter ciphertexts.

This efficiency improvement is the result of a surprising observation: previous hybrid schemes were proven secure by proving that both the KEM and the DEM were CCA2-secure. On the other hand, our KEM is not CCA2-secure, yet the whole scheme is, assuming the Decisional Diffie–Hellman (DDH) Assumption.

Finally we generalize our new scheme in two ways: (i) we show that security holds also if we use projective hash families (as the original Cramer–Shoup), and (ii) we show that in the random oracle model we can prove security under the weaker Computational Diffie–Hellman (CDH) Assumption.


Public key encryptionChosen ciphertext securityProjective hash proofs
Download to read the full article text

Copyright information

© International Association for Cryptologic Research 2009