Consider there is a protocol in real world, which uses a random oracle $\mathcal{H}$. In the ideal world, after the calling of $\mathcal{H}$ by some parties, intuitively I want the simulator gets some information from $\mathcal{H}$.

As Mikero pointed out in this question, the adversary may not call the oracle at all, and he can use some other (random) value instead.

To prevent this, I consider using a CCA-secure public cryptosystem, whose encryption key is only known by the oracle and the decryption key is only known by the simulator, under the assumption of common reference string. Then the output of the oracle, indeed a ciphertext (in hybrid worlds), will look like a random number due to the semantic security, and on the other hand, the simulator will know whether the "random value" is a legal ciphertext generated by the oracle, and the adversary will fail if he decides not to call the oracle.

So my questions are:

  1. Does this method work?
  2. What's the best way to do this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.