3
$\begingroup$

As I understand it, cryptosystems based on LWE/Ring-LWE are typically only IND-CPA, and fail to satisfy IND-CCA2. In fact, it appears that chosen ciphertext attacks could allow secret key recovery (!).

What is the best known IND-CCA2 secure encryption algorithm based on (Ring-)LWE? What about key exchange?

Improve this question
$\endgroup$
2
  • $\begingroup$ I think that having homomorphic properties precludes the ability to have IND-CCA2 status in general; I wish I had a better reference then this, but I can't seem to find one right now. $\endgroup$
    – Ella Rose
    Commented Jun 14, 2017 at 1:12
  • $\begingroup$ @EllaRose I know. I don't need or want homomorphic properties. $\endgroup$
    – Demi
    Commented Jun 14, 2017 at 1:16

1 Answer 1

Reset to default
3
$\begingroup$

If you don't mind relying on random oracles, the simplest approach is to apply a generic transformation such as Fujisaki-Okamoto to the (Ring-)LWE based scheme you start from. See for example Peikert's PQCrypto'14 paper for a concrete instantiation, and the TCC 2016 paper of Targhi and Unruh for a proof of security of this type of transform in the quantum random oracle model.

Lattice-based CCA2-secure encryption in the standard model is usually obtained using lattice trapdoors. The state-of-the-art construction is due to Micciancio and Peikert (section 6.3 of this EUROCRYPT 2012 paper).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.