0
$\begingroup$

Is there a way to transform the BGN encryption into non-malleable (i.e., IND-CCA2) without the use of symmetric encryption or signature?

I thought that simply publishing a proof of knowledge (via non interactive Sigma protocol) on $m$ is sufficient (i.e., if you have $E(m)= h^rg^m$ for some random nonce $r$), but I am concerned that the proof may be malleable. There is the Naor-Yung transformation in which the encryption involves encrypting a plaintext under two public keys, and then zero knowledge proof of proving this relation between the ciphertexts. I am not sure if this scheme is adequate, an if it can be further improved for BGN cryotosystem.

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy