# hybrid PKE scheme CCA2 insecurity

As we know, in hybrid PKE schemes XOR alone cannot perfectly hide challenge bit to the CCA2 adversary

1. The author does not define hybrid PKE schemes. What is their definition?

2. Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?

-
– Ricky Demer Nov 20 '13 at 2:21
Unless you have a good reason, I wouldn't worry too much about that paper. Why not read something else, like Bernstein, Lange and Peters (cr.yp.to/codes/mceliece-20080807.pdf) and its references? – K.G. Nov 20 '13 at 8:29
@K.G Why wouldn't worry too much about that paper? – juaninf Nov 20 '13 at 14:03
You learn more by reading better papers. – K.G. Nov 21 '13 at 7:48

The author does not define hybrid PKE schemes. What is their definition?

A hybrid public-key encryption scheme is a scheme that uses public-key encryption along with symmetric encryption to gain speed advantages for long messages.

The usual instantiation is to simply encrypt a key for the symmetric scheme and prepend the resulting cipher text. The more modern approach is to choose a random element from the PKE scheme's message space and encrypt it. Then use the hash of said element as the key for the symmetric scheme. This is called the KEM/DEM approach and allows for easier usage of elliptic curves (see ECIES) and code-based crypto (see McBits by Bernstein et al).

Why is it that XOR alone cannot perfectly hide challenge bit to the CCA2 adversary in hybrid PKE schemes?

This means that the following scheme isn't CCA2 secure. Encrypt by choosing a random key from the PKE's message space use this key as one-time-pad, prepend the random key - encrypted with the PKE. Decrypt by decrypting the random key with the PKE and then use the result to decrypt the data with the OTP. Note: The OTP could be replaced by a stream cipher and the key may also be the result of a key-derivation function.

You see what is missing here? The message is not authenticated.

Say you're given a cipher text $c$ for an unknown message $m$ to be decrypted (if you can you win the CCA2 experiment). Suppose further that $c=(E_{PK}(k),H(k)\oplus m)$ which is standard construction for this. Note that $H(k)=k$ is allowed. Now randomly choose a $r$ of length $||m||$ and compute $c'=(E_{PK}(k),H(k)\oplus m\oplus r)$. Note that $c\neq c'$. Now query the decryption oracle for $c'$ and obtain $m'=m\oplus r$. Now finally reconstruct the message $m=m'\oplus r$ and you have "won" the CCA2 experiment.

-