7 votes

Does Cramer-Shoup allow re-randomization?

@hakoja correctly points out that what you are asking for is not compatible with CCA security (the security property that Cramer-Shoup satisfies). More specifically, you seem to be looking for a ...
Mikero's user avatar
  • 13.2k
6 votes
Accepted

Does Cramer-Shoup allow re-randomization?

Answering only your first question: no, that's not possible. Essentially, if it was possible to randomize the ciphertext of Cramer-Shoup, then it wouldn't be IND-CCA2 secure. However it is IND-CCA2 ...
hakoja's user avatar
  • 2,725
5 votes
Accepted

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will ...
Mikero's user avatar
  • 13.2k
3 votes

ECCS: Elliptic Curve Cryptography Cramer Shoup

How to convert Cramer-Shoup into ECC? Because Cramer-Shoup restricts itself to using only group operations (and never using a single value as both a scalar and a group member), it can translate ...
poncho's user avatar
  • 147k
2 votes
Accepted

What's the proper way of fitting hash digest to encryption scheme?

A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary ...
Squeamish Ossifrage's user avatar
1 vote

Issues generating keys/cyclic group for Cramer-Shoup Cryptosystem with OpenSSL

I'm not familiar with the Cramer-Shoup cryptosystem, but it looks like you can obtain what's wanted by generating DSA parameters $P$, $Q$, $G$, yielding a Schnorr group of prime order $Q$ and ...
fgrieu's user avatar
  • 141k
1 vote
Accepted

Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

Of course, it doesn't mean that adversary knows how to solve discrete log. We just wanted to say that adversary only knows that the point $P$ lies somewhere on a plain $\cal{P}$ of such form. We don'...
Mikhail Koipish's user avatar
1 vote

Is Cramer-Shoup Lite IND-CCA secure?

It's far from a full proof, but if you use the sketch from Boaz Barak's lecture notes, together with the full proof of the full scheme from the Cramer-Shoup paper, you should be able to work it out.
Yehuda Lindell's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible