Timeline for Is there a partially homomorphic quantum secure public key cryptosystem with IND-CCA1 security?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 25, 2015 at 13:20 | vote | accept | SEJPM | ||
| Aug 24, 2015 at 12:54 | comment | added | Chris Peikert | Unfortunately no, the CCA1 proof breaks down entirely if you fix the tag matrices to be the same for all ciphertexts. The simulator needs to produce a challenge ciphertext at the tag on which the public key is "punctured," and needs decryption queries need to have different tags so the simulator can decrypt them. Also, I suspect that the scheme is actually insecure under CCA1 for the usual reasons, but haven't verified carefully. | |
| Aug 24, 2015 at 9:22 | comment | added | cygnusv | Now that I see it, you mention in your paper the possibility of setting $\mathbf H = \mathbf I$. In that case, and given that it seems that the encoding is additively homomorphic too, then this scheme could be an example of CCA1-secure lattice-based PKE that is additively homomorphic. | |
| Aug 24, 2015 at 8:50 | comment | added | cygnusv | At first I thought that your CCA1-secure scheme from EUROCRYPT 2012 may be additively homomorphic, but then I realized that the tag matrices $\mathbf H$ are random for each ciphertext, so it doens't work straightaway. Is it possible to fix these matrices without impacting security? Also, I don't know if the encoding of the messages is homomorphic too. | |
| Aug 24, 2015 at 0:12 | history | answered | Chris Peikert | CC BY-SA 3.0 |