1
$\begingroup$

Are real-or-random(rr) model and LR-model are equivalent?

In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent.

Here is what I really want to know:

When proving some cryptosystem(ex. ElGamal under DDH) are IND-CPA secure, can we just use real-or-random model? If not, how can we prove that ElGamal is IND-CPA secure using LR model?

Improve this question
$\endgroup$
1
  • $\begingroup$ Yes. This is a standard result. It is in textbooks. $\endgroup$
    – K.G.
    Jul 31, 2022 at 13:29

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.