# If DDH is hard then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following:

If decisional Diffie-Hellman problem is hard then there exists a CCA-secure public key encryption scheme.

How is this justified?

• By the existence of Cramer-Shoup encryption? – Maeher Feb 25 '19 at 16:58
• @Maeher yes i think that's an answer – Rodrigo Feb 25 '19 at 21:58

## 1 Answer

The answer is

Because Cramer-Shoup encryption exists.

The construction of Cramer-Shoup is essentially a modification of ElGamal encryption with an added checksum, that allows to detect tampering of ciphertexts.

The construction assumes a cyclic group $$\mathbb{G}$$ of order $$q$$ with two generators $$g_1,g_2$$ in which the DDH problem is hard, as well as a collision resistant hash function $$H : \mathbb{G}^3 \to \mathbb{Z}_q$$.

Collision resistant hash functions can be constructed based on the discrete logarithm assumption (See, e.g., Section 121 in these lecture notes by Rafael Pass. There's a bit more work involved in encoding inputs and outputs to match the required domain and range, but it's possible to do.) Since the discrete logarithm problem is hard if the DDH problem is hard, it thus follows that if DDH is hard, then CCA secure PKE exists.