# Secret key and Decryption oracle in the revised Fujisaki-Okamoto transformation

Recently, Fujisaki and Okamoto provided a revised version of the Fujisaki-Okamoto transformation [1], a generic transformation for achieving IND-CCA2 security in the Random Oracle model. This new version is slightly different than the original [2] and the security proof does not define a knowledge extractor (the original version actually proved that the transformation satisfies the Plaintext Awareness (PA) notion and used the fact that PA $\Rightarrow$ IND-CCA2 in the random oracle model). Instead, they directly provide an algorithm for the decryption oracle. When describing the decryption oracle construction, they stress that it does not require the secret key (in a similar way than the original version), and it only uses the information from previous random oracle queries.

Is this characteristic (i.e., not using the secret key) relevant in general for proofs for the IND-CCA2 notion, or is it simply something inherited in this particular case from the original transformation, aimed at the Plaintext Awareness notion? In other words, is there any inherent drawback in using the secret key in the decryption oracle when facing a security proof for IND-CCA2? I know that, usually, proofs are constructed as reductions to hard problems, which may force to define the decryption oracle without knowledge of the secret key. However, this does not seem to be the case.

I think I may be overthinking the problem, and that the answer may be a simple "No".

Update: I added some possible explanations in the comments. I'm starting to lean towards the answer "It is important in this particular proof, but not in general".

References:

[1] Fujisaki, E., & Okamoto, T. (2013). Secure integration of asymmetric and symmetric encryption schemes. Journal of Cryptology, 26(1), 80-101.

[2] Fujisaki, E., & Okamoto, T. (1999). Secure integration of asymmetric and symmetric encryption schemes. In Crypto (Vol. 99, No. 32, pp. 537-554). [link]

• A possible explanation is that the proof does not use the secret keys, only the random oracle tables, in order to maintain its genericity. As described in the question, some schemes are proven secure as reductions to a hard problem, in such a way that it is not possible to resort to the secret key (e.g., the public key is an element from a Diffie-Hellman tuple, so the secret key is unknown for the simulator). Does it make any sense? – cygnusv Jun 16 '15 at 15:16
• Somewhat related to my previous comment, I found another possible reason for not using the secret key. In the proof of Lemma 7.2 of [1], they construct an adversary $A^{asy}$ against the OWE notion of the asymmetric scheme that uses an adversary $A^{hyb}$, defined against the CCA-RO notion of the hybrid scheme. In this proof, $A^{asy}$ receives the public key from the challenger of the OWE game, but does not receive the corresponding secret key. Therefore, $A^{asy}$ cannot provide the key for $A^{hyb}$, and assuming knowledge of this key would invalidate this proof. – cygnusv Jun 24 '15 at 9:18