# The REACT transform and Replayable CCA

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme $\varepsilon_{pk}^{asym}$, an IND-secure symmetric encryption scheme $\varepsilon^{sym}$, and hash functions $H$ and $G$. The transform works as follows:

$c_1 = \varepsilon_{pk}^{asym}(R), c_2 = \varepsilon_{K}^{sym}(m)$, where $K = G(R)$ and $R$ is chosen at random.

Then $\varepsilon'_{pk}(m) = (c_1, c_2, H(R,m,c_1,c_2))$

My questions are: Why is it necessary to include $c_1$ in the hash $H$? What would be the consequences of dropping it from the hash (i.e., $\varepsilon''_{pk}(m) = (c_1,c_2, H(R,m,c_2))$? I guess that the main reason is to achieve non-malleability, but is it possible that by dropping it we obtain a transform to Replayable CCA (RCCA) security [CKN03]? Informally, RCCA was like CCA security “except that they allow anyone to generate new ciphertexts that decrypt to the same value as a given ciphertext” [CKN03]. Since we are including $m$ in the hash, we can guarantee that the original message is preserved, but we allow modifications on $c_1$.

I am asking this because I'm interested in schemes where a certain degree of malleability is permitted. In particular, re-encryptions of the original ciphertext are permitted, as long as they decrypt to the original message.

References:

• [OP01] Okamoto, T., & Pointcheval, D. (2001). REACT: Rapid enhanced-security asymmetric cryptosystem transform. In Topics in Cryptology—CT-RSA 2001 (pp. 159-174). Springer Berlin Heidelberg. $\rightarrow$ PDF

• [CKN03] Canetti, R., Krawczyk, H., & Nielsen, J. B. (2003). Relaxing chosen-ciphertext security. In Advances in Cryptology-CRYPTO 2003 (pp. 565-582). $\rightarrow$ PDF

-
You might be interested in one of these two papers. $\;$ – Ricky Demer Jul 28 '14 at 20:01
Also, "an IND-secure symmetric encryption scheme" with respect to CPA or CCA? – Ricky Demer Jul 29 '14 at 21:27

I believe it would match the relaxed RCCA security, but it looks like it wouldn't be of much use because reencryption would not be secure. You could generate reencryptions of any ciphertext, but they would not be indistinguishable from each other, i.e. given $c_1$ and $c_2$ you can determine easily whether $c_2$ is a reencryption of $c_1$.
I don't understand why you say re-encryption would not be secure. Could you please elaborate further on this? To be more specific with my questions, I am interested in this in the context of Proxy Re-Encryption. In this context, a proxy entity who has a special re-encryption key would be able to transform a ciphertext $C_A$ (decryptable by user A) to a ciphertext $C_B$ (decryptable by user B). That is, $C_B$ is a re-encryption of $C_A$. So, what I'm trying to understand is whether applying this modified REACT construction to a CPA-secure proxy re-encryption scheme would make it RCCA-secure – cygnusv Jul 29 '14 at 8:51