Abstract
We present a new encryption scheme which is secure against adaptive chosen-ciphertext attack (or CCA2-secure) in the standard model (i.e., without the use of random oracle). Our scheme is a hybrid one: it first uses a public-key step (the Key Encapsulation Module or KEM) to encrypt a random key, which is then used to encrypt the actual message using a symmetric encryption algorithm (the Data Encapsulation Module or DEM).
Our scheme is a modification of the hybrid scheme presented by Shoup in (Euro-Crypt’97, Springer LNCS, vol. 1233, pp. 256–266, 1997) (based on the Cramer–Shoup scheme in CRYPTO’98, Springer LNCS, vol. 1462, pp. 13–25, 1998). Its major practical advantage is that it saves the computation of one exponentiation and produces shorter ciphertexts.
This efficiency improvement is the result of a surprising observation: previous hybrid schemes were proven secure by proving that both the KEM and the DEM were CCA2-secure. On the other hand, our KEM is not CCA2-secure, yet the whole scheme is, assuming the Decisional Diffie–Hellman (DDH) Assumption.
Finally we generalize our new scheme in two ways: (i) we show that security holds also if we use projective hash families (as the original Cramer–Shoup), and (ii) we show that in the random oracle model we can prove security under the weaker Computational Diffie–Hellman (CDH) Assumption.
Article PDF
Similar content being viewed by others
References
M. Abe, R. Gennaro, K. Kurosawa, Tag-KEM/DEM: a new framework for hybrid encryption. J. Cryptol. 21(1), 97–130 (2008)
M. Bellare, P. Rogaway, Random oracles are practical: a paradigm for designing efficient protocols, in 1993 ACM Conference on Computer and Communications Security (ACM, New York, 1993), pp. 62–73
R. Canetti, O. Goldreich, S. Halevi, The random oracle methodology, revisited. J. ACM 51(4), 557–594 (2004)
R. Cramer, V. Shoup, A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack, in CRYPTO’98. Springer LNCS, vol. 1462 (Springer, Berlin, 1998), pp. 13–25
R. Cramer, V. Shoup, Universal hash proofs and a paradigm for chosen ciphertext secure public key encryption, in EuroCrypt’02. Springer LNCS, vol. 2332 (Springer, Berlin, 2002), pp. 45–64
R. Cramer, V. Shoup, Design and analysis of practical public-key encryption schemes secure against adaptive chosen ciphertext attack. SIAM J. Comput. 33, 167–226 (2003)
W. Diffie, M. Hellman, New directions in cryptography. IEEE Trans. Inf. Theory IT-22(6), 644–654 (1976)
D. Dolev, C. Dwork, M. Naor, Non-malleable cryptography, in STOC’91 (1991), pp. 542–552
R. Gennaro, V. Shoup, A Note on An Encryption Scheme of Kurosawa and Desmedt. IACR Eprint Archive http://eprint.iacr.org/2004/194
J. Herranz, D. Hofheinz, E. Kiltz, The Kurosawa–Desmedt Key Encapsulation is not Chosen-Ciphertext Secure. IACR Eprint Archive http://eprint.iacr.org/2006/207
D. Hofheinz, E. Kiltz, Secure hybrid encryption from weakened key encapsulation, in CRYPTO 2007. Springer LNCS, vol. 4622 (Springer, Berlin, 2007), pp. 553–571
K. Kurosawa, Y. Desmedt, A New Paradigm of Hybrid Encryption Scheme, in CRYPTO’04. Springer LNCS, vol. 3152 (Springer, Berlin, 2004), pp. 426–442
M. Naor, M. Yung, Public-key cryptosystems provably secure against chosen ciphertext attacks, in Proceedings of the Twenty Second Annual ACM Symposium on Theory of Computing, STOC’90 (ACM, New York, 1990), pp. 427–437
M. Naor, M. Yung, Universal one-way hash functions and their cryptographic applications, in Proceedings of the Twenty First Annual ACM Symposium on Theory of Computing, STOC’89 (ACM, New York, 1989), pp. 33–43
C. Rackoff, D. Simon, Noninteractive zero-knowledge proof of knowledge and chosen ciphertext attack, in CRYPTO’91. Springer LNCS, vol. 576 (Springer, Berlin, 1991), pp. 433–444
J. Rompel, One-way functions are necessary and sufficient for secure signatures, in Proceedings of the Twenty Second Annual ACM Symposium on Theory of Computing, STOC’90 (ACM, New York, 1990), pp. 387–394
V. Shoup, Lower bounds for discrete logarithms and related problems, in EuroCrypt’97. Springer LNCS, vol. 1233 (Springer, Berlin, 1997), pp. 256–266
V. Shoup, Using hash functions as a hedge against chosen ciphertext attack, in EuroCrypt’00. Springer LNCS, vol. 1807 (Springer, Berlin, 2000), pp. 275–288
Author information
Authors and Affiliations
Corresponding author
Additional information
Communicated by Ronald Cramer
Rights and permissions
About this article
Cite this article
Desmedt, Y., Gennaro, R., Kurosawa, K. et al. A New and Improved Paradigm for Hybrid Encryption Secure Against Chosen-Ciphertext Attack. J Cryptol 23, 91–120 (2010). https://doi.org/10.1007/s00145-009-9051-4
Received:
Revised:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s00145-009-9051-4