1
$\begingroup$

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $M = \{0, 1\}^n$, and SE is a Symmetric Key Encryption(SKE) with key space $\{0, 1\}^n$ and message space $M' = \{0, 1\}^*$ then the hybrid encryption uses the same key generation KG, but its message space is $M' = \{0, 1\}^*$ and its encryption procedure $Enc'(p_k, m)$ picks a random symmetric key $k \gets \{0, 1\}^n$ and outputs ciphertext $(c, c')$ where $c = Enc(p_k, k)$ and $c' = SE(k, m)$. The decryption given $(c, c')$ decrypts $k$ from $c$ using the private key corresponding to pk and then decrypts $m$ from $c'$ using $k$.

If Enc is a CPA secure PKE on $M = \{0, 1\}^n$ and SE is IND secure SKE on$ M' = \{0, 1\}^*$, is Enc' CPA secure PKE on $M'$?

If Enc is CPA secure PKE and SE is CCA secure SKE, is Enc' CCA secure?

$\endgroup$
  • $\begingroup$ Not quite sure, but intuition tells me that Enc should be CCA secure (at least when considering active adversaries). $\endgroup$ – VincBreaker Jun 2 at 12:49
  • $\begingroup$ So "Introduction to Modern Cryptography" talks a bit about hybrid encryption and KEMs. It would appear that plain CPA-secure encryption doesn't yield a CCA-secure KEM (because eg ElGamal is CPA secure but you can win the KEM-CCA game using the homomorphism) and the book requires a CCA secure KEM for CCA secure hybrid encryption. $\endgroup$ – SEJPM Jun 4 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.