Is there a way to transform the BGN encryption into non-malleable (i.e., IND-CCA2) without the use of symmetric encryption or signature?

I thought that simply publishing a proof of knowledge (via non interactive Sigma protocol) on $m$ is sufficient (i.e., if you have $E(m)= h^rg^m$ for some random nonce $r$), but I am concerned that the proof may be malleable. There is the Naor-Yung transformation in which the encryption involves encrypting a plaintext under two public keys, and then zero knowledge proof of proving this relation between the ciphertexts. I am not sure if this scheme is adequate, an if it can be further improved for BGN cryotosystem.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy