Are real-or-random(rr) model and LR-model are equivalent?

In the definition of ciphertext indistinguishability, LR-model is used. However I think rr model and LR model are somewhat equivalent.

Here is what I really want to know:

When proving some cryptosystem(ex. ElGamal under DDH) are IND-CPA secure, can we just use real-or-random model? If not, how can we prove that ElGamal is IND-CPA secure using LR model?

  • $\begingroup$ Yes. This is a standard result. It is in textbooks. $\endgroup$
    – K.G.
    Jul 31, 2022 at 13:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.