# Tag Info

7

@hakoja correctly points out that what you are asking for is not compatible with CCA security (the security property that Cramer-Shoup satisfies). More specifically, you seem to be looking for a rerandomizable, RCCA-secure encryption scheme. These two properties mean: Rerandomizable: Given an encryption of an unknown $m$, there is a way to generate fresh ...

6

Answering only your first question: no, that's not possible. Essentially, if it was possible to randomize the ciphertext of Cramer-Shoup, then it wouldn't be IND-CCA2 secure. However it is IND-CCA2 secure, so it cannot be re-randomizable.

4

CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will decrypt properly): $$(g_1^r, g_2^r, A^r m_1, B^r) \cdot (g_1^s, g_2^s, A^s m_2, B^s) = (g_1^{r+s}, g_2^{r+s}, A^{r+s} (m_1m_2), B^{r+s})$$ So a simple CCA2 ...

3

Yes, if you allow to introduce other primitives into the PKE scheme. The Kurosawa-Desmedt scheme is an example whose secret key consists of four exponents in $\mathbb{Z}_q$. Let us fix a group $\mathbb{G}$ of prime order $q$. Let $H$ be a secure hash function (TCR security). Cramer and Shoup Let us review the Cramer-Shoup scheme. As you wrote, the scheme ...

2

A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary commits to a message $m$, then upon being challenged with a random $r$, the adversary cannot find a distinct message $m' \ne m$ such that $H_r(m) = H_r(m')$. (...

2

A Cramer-Shoup public key has the form: $B = g_1^{b_1} g_2^{b_2}; \quad C = g_1^{c_1} g_2^{c_2}; \quad D = g_1^{d_1} g_2^{d_2}$ and an encryption of $m$ has the form: $g_1^r, ~ g_2^r, ~ m B^r, ~ (CD^\mu)^r$ where $\mu$ is a hash of the first 3 components. CCA security proof breaks down: In the CCA security proof, you observe that if you know the ...

1

Of course, it doesn't mean that adversary knows how to solve discrete log. We just wanted to say that adversary only knows that the point $P$ lies somewhere on a plain $\cal{P}$ of such form. We don't suppose that adversary knows actual parameters of the plane. But it's enough for us to deduce that $\cal{P}$ intersects with another plane $\cal{H}$ (which ...

1

Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...

Only top voted, non community-wiki answers of a minimum length are eligible