I am trying to implement a cramer-shoup cryptosystem but I don't understand how to work with the plaintext I want to encrypt.

From what I understand, the plaintext needs to be converted to an element of the cyclic group G, which was generated with the key. I've checked multiple resources, from the wiki to several papers, and none of them seem to take the time to explain how to convert a plaintext message to an element of G.

The wiki simply says

"Bob converts m into an element of G"

And the paper I'm looking at by Cramer and Shoup simply says

"We also assume that cleartext messages are (or can be encoded as) elements of G (although this condition can be relaxed--see 5.2)"

Even after checking the other part of the paper it referenced there weren't any instructions on how to perform this conversion.

If I have a plaintext message m, how would I convert it to an element of a cyclic group as the process describes? How do you convert a message to an element of a cyclic group?

  • $\begingroup$ Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. $\endgroup$
    – Community
    Nov 22 '21 at 1:51
  • $\begingroup$ I've edited the post to clarify my question. $\endgroup$
    – KoiNip
    Nov 22 '21 at 5:17
  • 4
    $\begingroup$ The easiest way would be not to. Encrypt a random group element and use hybrid encryption. Since your message is not from the group it would appear that you do not actually need the algebraic structure provided by CS. Of you want to directly encrypt the message, you will need to specify the exact group you're using. Afaik there's no generic way to do this. $\endgroup$
    – Maeher
    Nov 22 '21 at 8:45
  • $\begingroup$ @Maeher Given the reason for Cramer-Shoup, I suppose you would want to use a non-malleable (i.e. authenticated) mode of operation? Or should that even have a stronger notion of security? $\endgroup$
    – Maarten Bodewes
    Nov 22 '21 at 9:54
  • $\begingroup$ Combining a CCA secure KEM and a CCA secure symmetric encryption scheme gives you CCA secure hybrid encryption. So, if by authenticated encryption you mean IND-CPA+INT-CTXT, then yes, those imply CCA security. $\endgroup$
    – Maeher
    Nov 22 '21 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.