I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.

However, it seems that (when used as a KEM) that any $\text{IND-CPA}$ secure scheme can be converted to a secure-in-practice scheme by hashing the exchanged key before using it. The hash function seems to ensure that no information is leaked. By using an AEAD for the encrypted data, and including the KEM ciphertext in the AAD, it seems that the scheme becomes $\text{IND-CCA2}$.

What is the flaw in this scheme?

  • $\begingroup$ This leaves open the possibility of generating a different ciphertext that encrypts to the same key. Maybe your proposal can achieve a weaker notion like RCCA security. $\endgroup$
    – Mikero
    Commented Jun 15, 2017 at 1:45
  • $\begingroup$ If you have a secure KEM, you can "trivially" construct an IND-CCA2 secure scheme. Now the trick is to create secure KEM and the way it's "usually" (ie with DHIES, ECIES and RSA-KEM) is to take your hard problem, create an instance of it that satisfies the precise hardness assumption and then hash (using the Random-Oracle model) the part of it that was hard to recover. $\endgroup$
    – SEJPM
    Commented Jun 15, 2017 at 13:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.