4
$\begingroup$

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.

However, it seems that (when used as a KEM) that any $\text{IND-CPA}$ secure scheme can be converted to a secure-in-practice scheme by hashing the exchanged key before using it. The hash function seems to ensure that no information is leaked. By using an AEAD for the encrypted data, and including the KEM ciphertext in the AAD, it seems that the scheme becomes $\text{IND-CCA2}$.

What is the flaw in this scheme?

Improve this question
$\endgroup$
2
  • $\begingroup$ This leaves open the possibility of generating a different ciphertext that encrypts to the same key. Maybe your proposal can achieve a weaker notion like RCCA security. $\endgroup$
    – Mikero
    Jun 15, 2017 at 1:45
  • $\begingroup$ If you have a secure KEM, you can "trivially" construct an IND-CCA2 secure scheme. Now the trick is to create secure KEM and the way it's "usually" (ie with DHIES, ECIES and RSA-KEM) is to take your hard problem, create an instance of it that satisfies the precise hardness assumption and then hash (using the Random-Oracle model) the part of it that was hard to recover. $\endgroup$
    – SEJPM
    Jun 15, 2017 at 13:00

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.