7
$\begingroup$

Before stating my questions, let us recall the REACT transform [OP01], which enables to construct a CCA-secure hybrid PKE scheme, $\varepsilon'_{pk}$, from an OW-CPA PKE scheme $\varepsilon_{pk}^{asym}$, an IND-secure symmetric encryption scheme $\varepsilon^{sym}$, and hash functions $H$ and $G$. The transform works as follows:

$c_1 = \varepsilon_{pk}^{asym}(R), c_2 = \varepsilon_{K}^{sym}(m)$, where $K = G(R)$ and $R$ is chosen at random.

Then $\varepsilon'_{pk}(m) = (c_1, c_2, H(R,m,c_1,c_2))$

My questions are: Why is it necessary to include $c_1$ in the hash $H$? What would be the consequences of dropping it from the hash (i.e., $\varepsilon''_{pk}(m) = (c_1,c_2, H(R,m,c_2))$? I guess that the main reason is to achieve non-malleability, but is it possible that by dropping it we obtain a transform to Replayable CCA (RCCA) security [CKN03]? Informally, RCCA was like CCA security “except that they allow anyone to generate new ciphertexts that decrypt to the same value as a given ciphertext” [CKN03]. Since we are including $m$ in the hash, we can guarantee that the original message is preserved, but we allow modifications on $c_1$.

I am asking this because I'm interested in schemes where a certain degree of malleability is permitted. In particular, re-encryptions of the original ciphertext are permitted, as long as they decrypt to the original message.

References:

  • [OP01] Okamoto, T., & Pointcheval, D. (2001). REACT: Rapid enhanced-security asymmetric cryptosystem transform. In Topics in Cryptology—CT-RSA 2001 (pp. 159-174). Springer Berlin Heidelberg. $\rightarrow$ PDF

  • [CKN03] Canetti, R., Krawczyk, H., & Nielsen, J. B. (2003). Relaxing chosen-ciphertext security. In Advances in Cryptology-CRYPTO 2003 (pp. 565-582). $\rightarrow$ PDF

|improve this question
$\endgroup$
  • 1
    $\begingroup$ You might be interested in one of these two papers. $\;$ $\endgroup$ – user991 Jul 28 '14 at 20:01
  • $\begingroup$ Also, "an IND-secure symmetric encryption scheme" with respect to CPA or CCA? $\endgroup$ – user991 Jul 29 '14 at 21:27
4
$\begingroup$

I believe it would match the relaxed RCCA security, but it looks like it wouldn't be of much use because reencryption would not be secure. You could generate reencryptions of any ciphertext, but they would not be indistinguishable from each other, i.e. given $c_1$ and $c_2$ you can determine easily whether $c_2$ is a reencryption of $c_1$.

|improve this answer
$\endgroup$
  • $\begingroup$ I don't understand why you say re-encryption would not be secure. Could you please elaborate further on this? To be more specific with my questions, I am interested in this in the context of Proxy Re-Encryption. In this context, a proxy entity who has a special re-encryption key would be able to transform a ciphertext $C_A$ (decryptable by user A) to a ciphertext $C_B$ (decryptable by user B). That is, $C_B$ is a re-encryption of $C_A$. So, what I'm trying to understand is whether applying this modified REACT construction to a CPA-secure proxy re-encryption scheme would make it RCCA-secure $\endgroup$ – cygnusv Jul 29 '14 at 8:51
  • $\begingroup$ I'm sorry, I forgot that c1 and c2 were already defined in your question, let me try to explain again. RCCA security says that the ciphertexts generated by the encryption function will be indistinguishable under CCA, as long as the oracle is restricted so that ciphertexts which decrypt to the same value as one of the challenge cihpertexts cannot be queried during the second learning phase. So it is a relaxation of CCA security, like it says in the title. However, it says nothing about the security of the reencryption function. $\endgroup$ – Travis Mayberry Jul 29 '14 at 23:36
  • $\begingroup$ You can use some homomorphism of your asymmetric crypto system to reencrypt c_1, but c_2 cannot be changed. Therefore, given a ciphertext C_a = (c_1, c_2), I can generate a new ciphertext C_b = (c'_1, c_2), but it will be immediately apparent to anyone that sees C_a and C_b that C_b is a reencryption of C_a, due to the fact that the second part of the ciphertext is the same in both. You cannot reencrypt that part because it is done with a CCA secure symmetric cipher, which likely will not have any homomorphic properties. $\endgroup$ – Travis Mayberry Jul 29 '14 at 23:38
  • $\begingroup$ I would add more. The scheme you propose, namely, REACT with H(m, R, c2), cannot be "rerandomizable" unless PRF implies PKE. In fact, given a procedure that ReRandom c2 you can define a PKE. The construction is easy: let pk = SimmetricEnc(0),SimmetricEnc(1). To encrypt 0 rerandomize the first element of pk otherwise the second. $\endgroup$ – AntonioFa Feb 16 '17 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.