Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm reading "An Efficient CCA2-Secure Variant of the McEliece Cryptosystem in the standard model" by Rastaghi which states:

As we know, in hybrid PKE schemes XOR alone cannot perfectly hide challenge bit to the CCA2 adversary

  1. The author does not define hybrid PKE schemes. What is their definition?

  2. Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?

share|improve this question
    
1. en.wikipedia.org/wiki/Hybrid_cryptosystem $\;$ – Ricky Demer Nov 20 '13 at 2:21
1  
Unless you have a good reason, I wouldn't worry too much about that paper. Why not read something else, like Bernstein, Lange and Peters (cr.yp.to/codes/mceliece-20080807.pdf) and its references? – K.G. Nov 20 '13 at 8:29
    
@K.G Why wouldn't worry too much about that paper? – juaninf Nov 20 '13 at 14:03
    
You learn more by reading better papers. – K.G. Nov 21 '13 at 7:48

The author does not define hybrid PKE schemes. What is their definition?

A hybrid public-key encryption scheme is a scheme that uses public-key encryption along with symmetric encryption to gain speed advantages for long messages.

The usual instantiation is to simply encrypt a key for the symmetric scheme and prepend the resulting cipher text. The more modern approach is to choose a random element from the PKE scheme's message space and encrypt it. Then use the hash of said element as the key for the symmetric scheme. This is called the KEM/DEM approach and allows for easier usage of elliptic curves (see ECIES) and code-based crypto (see McBits by Bernstein et al).

Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?

This means that the following scheme isn't CCA2 secure. Encrypt by choosing a random key from the PKE's message space use this key as one-time-pad, prepend the random key - encrypted with the PKE. Decrypt by decrypting the random key with the PKE and then use the result to decrypt the data with the OTP. Note: The OTP could be replaced by a stream cipher and the key may also be the result of a key-derivation function.

You see what is missing here? The message is not authenticated.

Say you're given a cipher text $c$ for an unknown message $m$ to be decrypted (if you can you win the CCA2 experiment). Suppose further that $c=(E_{PK}(k),H(k)\oplus m)$ which is standard construction for this. Note that $H(k)=k$ is allowed. Now randomly choose a $r$ of length $||m||$ and compute $c'=(E_{PK}(k),H(k)\oplus m\oplus r)$. Note that $c\neq c'$. Now query the decryption oracle for $c'$ and obtain $m'=m\oplus r$. Now finally reconstruct the message $m=m'\oplus r$ and you have "won" the CCA2 experiment.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.