Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 security. So, if we use the regular method to convert a CPA secure scheme to CCA2 secure scheme (using a hash of the message and a random value), will it still preserve its homomorphic property? Please correct me if my understanding is wrong.

share|improve this question
You might find this paper interesting. $\;$ – Ricky Demer Jul 3 '14 at 13:59
up vote 3 down vote accepted

The best you can get for homomorphic encryption schemes is non-adaptive chosen ciphertext security (IND-CCA1 security), see e.g. here for a quite up to date characterization.

As you rightly observe homomorphic encryption schemes are malleable by definition and cannot provide adaptive security against chosen ciphertext attacks (be IND-CCA2 secure).

Since in the IND-CCA2 security game the adversary knows the relationship between both messages for the challenge ciphertext, the adversary can obtain another ciphertext to a chosen plaintext and operate on the challenge ciphertext and the newly obtained ciphertext and then submitting the resulting ciphertext to the decryption oracle. This does not violate the conditions of the IND-CCA2 game (the adversary is only restricted to not submit the challenge ciphertext directly to the decryption oracle). Consequently, the adversary can determine which plaintext is hidden in the challenge ciphertext.

The reason why IND-CCA1 security can however still be achieved for homomorphic encryption schemes is that in the IND-CCA1 game the adversary after having obtained the challenge ciphertext no longer has access to a decryption oracle (and thus eliminating the aforementioned strategy).

Concluding, every compiler/transform (like Fujisaki-Okamoto or Naor-Yung double encryption) that takes a less secure scheme (IND-CPA) and converts it into an IND-CCA2 secure scheme destroys the homomorphic property of the original scheme.

share|improve this answer
is it true to say for FHE scheme also best possible is IND-CCA1 ? or FHE schemes are much less secure ? – sashank Oct 30 '15 at 23:29
@sashank Yes, it is also the best possible for FHE schemes (using the same argumentation). – DrLecter Oct 31 '15 at 8:06
Any known FHE schemes that are CCA1 secure ? Probably you can help answer this… – sashank Oct 31 '15 at 10:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.