Is it possible to modify a homomorphic encryption scheme so that it can be CCA2 secure? From the definition of a homomorphic scheme, it seems that it is malleable, which would result in lack of CCA2 security. So, if we use the regular method to convert a CPA secure scheme to CCA2 secure scheme (using a hash of the message and a random value), will it still preserve its homomorphic property? Please correct me if my understanding is wrong.
$\begingroup$
$\endgroup$
1
-
$\begingroup$ You might find this paper interesting. $\;$ $\endgroup$– user991Jul 3, 2014 at 13:59
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
The best you can get for homomorphic encryption schemes is non-adaptive chosen ciphertext security (IND-CCA1 security), see e.g. here for a quite up to date characterization.
As you rightly observe homomorphic encryption schemes are malleable by definition and cannot provide adaptive security against chosen ciphertext attacks (be IND-CCA2 secure).
Since in the IND-CCA2 security game the adversary knows the relationship between both messages for the challenge ciphertext, the adversary can obtain another ciphertext to a chosen plaintext and operate on the challenge ciphertext and the newly obtained ciphertext and then submitting the resulting ciphertext to the decryption oracle. This does not violate the conditions of the IND-CCA2 game (the adversary is only restricted to not submit the challenge ciphertext directly to the decryption oracle). Consequently, the adversary can determine which plaintext is hidden in the challenge ciphertext.
The reason why IND-CCA1 security can however still be achieved for homomorphic encryption schemes is that in the IND-CCA1 game the adversary after having obtained the challenge ciphertext no longer has access to a decryption oracle (and thus eliminating the aforementioned strategy).
Concluding, every compiler/transform (like Fujisaki-Okamoto or Naor-Yung double encryption) that takes a less secure scheme (IND-CPA) and converts it into an IND-CCA2 secure scheme destroys the homomorphic property of the original scheme.
-
$\begingroup$ is it true to say for FHE scheme also best possible is IND-CCA1 ? or FHE schemes are much less secure ? $\endgroup$– sashankOct 30, 2015 at 23:29
-
$\begingroup$ @sashank Yes, it is also the best possible for FHE schemes (using the same argumentation). $\endgroup$– DrLecterOct 31, 2015 at 8:06
-
$\begingroup$ Any known FHE schemes that are CCA1 secure ? Probably you can help answer this crypto.stackexchange.com/questions/30191/… $\endgroup$– sashankOct 31, 2015 at 10:33