How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme that is CPA-secure?

The given definition is as followed: enter image description here

Actually this is an exercise of the book "Introduction to modern cryptography", I can figure out how to prove it.

Can someone help me? Thanks a lot!


My reputation won't let me post this as a comment, but I believe you could simply use the key exchange as a one time pad.

Alice and Bob could use the key-exchange as normal. Alice initiates the key-exchange and sends the first round. Bob sends the second round. They now both have enough information to generate a shared key of length $k$ bits, which is CPA secure. Bob then sends a message of length $l \leq k$ XORed with the shared key (obviously only sending $l$ bits). Alice can decrypt this message, simply by XORing with the shared key.

Note that the entire key exchange needs to be repeated for each block of $k$ message bits. This repetition must be secure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.