7
@hakoja correctly points out that what you are asking for is not compatible with CCA security (the security property that Cramer-Shoup satisfies). More specifically, you seem to be looking for a rerandomizable, RCCA-secure encryption scheme. These two properties mean:
Rerandomizable: Given an encryption of an unknown $m$, there is a way to generate fresh ...
6
Answering only your first question: no, that's not possible. Essentially, if it was possible to randomize the ciphertext of Cramer-Shoup, then it wouldn't be IND-CCA2 secure. However it is IND-CCA2 secure, so it cannot be re-randomizable.
4
CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will decrypt properly):
$$(g_1^r, g_2^r, A^r m_1, B^r) \cdot (g_1^s, g_2^s, A^s m_2, B^s) = (g_1^{r+s}, g_2^{r+s}, A^{r+s} (m_1m_2), B^{r+s})$$
So a simple CCA2 ...
3
Yes, if you allow to introduce other primitives into the PKE scheme.
The Kurosawa-Desmedt scheme is an example whose secret key consists of four exponents in $\mathbb{Z}_q$.
Let us fix a group $\mathbb{G}$ of prime order $q$. Let $H$ be a secure hash function (TCR security).
Cramer and Shoup
Let us review the Cramer-Shoup scheme. As you wrote, the scheme ...
2
A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary commits to a message $m$, then upon being challenged with a random $r$, the adversary cannot find a distinct message $m' \ne m$ such that $H_r(m) = H_r(m')$. (...
answered Nov 10 '19 at 18:57
Squeamish Ossifrage
42.9k33 gold badges8585 silver badges180180 bronze badges
2
A Cramer-Shoup public key has the form:
$B = g_1^{b_1} g_2^{b_2}; \quad C = g_1^{c_1} g_2^{c_2}; \quad D = g_1^{d_1} g_2^{d_2}$
and an encryption of $m$ has the form:
$g_1^r, ~ g_2^r, ~ m B^r, ~ (CD^\mu)^r$
where $\mu$ is a hash of the first 3 components.
CCA security proof breaks down:
In the CCA security proof, you observe that if you know the ...
1
Of course, it doesn't mean that adversary knows how to solve discrete log.
We just wanted to say that adversary only knows that the point $P$ lies
somewhere on a plain $\cal{P}$ of such form.
We don't suppose that adversary knows actual parameters of the plane.
But it's enough for us to deduce that $\cal{P}$ intersects with another plane $\cal{H}$ (which ...
1
Yes, this is possible.
One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation.
However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...
Only top voted, non community-wiki answers of a minimum length are eligible
Related Tags
cramer-shoup × 10public-key × 6
chosen-ciphertext-attack × 4
encryption × 3
elgamal-encryption × 2
hash × 1
elliptic-curves × 1
provable-security × 1
discrete-logarithm × 1
backdoors × 1