Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 security. So, if we use the regular method to convert a CPA secure scheme to CCA2 secure scheme (using a hash of the message and a random value), will it still preserve its homomorphic property? Please correct me if my understanding is wrong.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
The best you can get for homomorphic encryption schemes is non-adaptive chosen ciphertext security (IND-CCA1 security), see e.g. here for a quite up to date characterization.
As you rightly observe homomorphic encryption schemes are malleable by definition and cannot provide adaptive security against chosen ciphertext attacks (be IND-CCA2 secure).
Since in the IND-CCA2 security game the adversary knows the relationship between both messages for the challenge ciphertext, the adversary can obtain another ciphertext to a chosen plaintext and operate on the challenge ciphertext and the newly obtained ciphertext and then submitting the resulting ciphertext to the decryption oracle. This does not violate the conditions of the IND-CCA2 game (the adversary is only restricted to not submit the challenge ciphertext directly to the decryption oracle). Consequently, the adversary can determine which plaintext is hidden in the challenge ciphertext.
The reason why IND-CCA1 security can however still be achieved for homomorphic encryption schemes is that in the IND-CCA1 game the adversary after having obtained the challenge ciphertext no longer has access to a decryption oracle (and thus eliminating the aforementioned strategy).
Concluding, every compiler/transform (like Fujisaki-Okamoto or Naor-Yung double encryption) that takes a less secure scheme (IND-CPA) and converts it into an IND-CCA2 secure scheme destroys the homomorphic property of the original scheme.