I think most of us know the notion Shoup introduced of KEM/DEM (Key Encapsulation Mechanism / Data Encapsulation Mechanism) which is used for example by the (famous) ECIES, where the key is the hash of some random element which can only be recovered by the legitimate owner of the private key and the sender.

Now Bernstein et. al. "recently" proposed the code-based public key encryption system they call "McBits". McBits works similar to McEliece, meaning you introduce some random error into a "message" which only the owner of the private key can recover as only he has the necessary recovery "tools". In application the system chooses some random valid vector, uses the hash of this as key for Salsa20/Poly1305 and introduces the errors. The receiver can then use the decoding and the authentication check for integrity-confirmation. In their paper Bernstein et. al. claim McBits has IND-CCA2 security, however, I don't see any formal proof for this in the description of the PKCS.

I think that the IND-CCA2 security comes from the fact that they're using the KEM/DEM construction.

Hence my question:
What security assurances does the asymmetric primitive have to provide in order for the whole integrated encryption scheme (IES) to be secure?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.