Tag Info

@hakoja correctly points out that what you are asking for is not compatible with CCA security (the security property that Cramer-Shoup satisfies). More specifically, you seem to be looking for a rerandomizable, RCCA-secure encryption scheme. These two properties mean: Rerandomizable: Given an encryption of an unknown $m$, there is a way to generate fresh ...

Answering only your first question: no, that's not possible. Essentially, if it was possible to randomize the ciphertext of Cramer-Shoup, then it wouldn't be IND-CCA2 secure. However it is IND-CCA2 secure, so it cannot be re-randomizable.

CS-lite has the same homomorphic properties as ElGamal. In particular, compontentwise product of $\textsf{Enc}(pk,m_1)$ and $\textsf{Enc}(pk,m_2)$ is a valid encryption of $m_1 m_2$ (and hence will decrypt properly): $$(g_1^r, g_2^r, A^r m_1, B^r) \cdot (g_1^s, g_2^s, A^s m_2, B^s) = (g_1^{r+s}, g_2^{r+s}, A^{r+s} (m_1m_2), B^{r+s})$$ So a simple CCA2 ...

Yes, if you allow to introduce other primitives into the PKE scheme. The Kurosawa-Desmedt scheme is an example whose secret key consists of four exponents in $\mathbb{Z}_q$. Let us fix a group $\mathbb{G}$ of prime order $q$. Let $H$ be a secure hash function (TCR security). Cramer and Shoup Let us review the Cramer-Shoup scheme. As you wrote, the scheme ...

A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary commits to a message $m$, then upon being challenged with a random $r$, the adversary cannot find a distinct message $m' \ne m$ such that $H_r(m) = H_r(m')$. (...

A Cramer-Shoup public key has the form: $B = g_1^{b_1} g_2^{b_2}; \quad C = g_1^{c_1} g_2^{c_2}; \quad D = g_1^{d_1} g_2^{d_2}$ and an encryption of $m$ has the form: $g_1^r, ~ g_2^r, ~ m B^r, ~ (CD^\mu)^r$ where $\mu$ is a hash of the first 3 components. CCA security proof breaks down: In the CCA security proof, you observe that if you know the ...

Of course, it doesn't mean that adversary knows how to solve discrete log. We just wanted to say that adversary only knows that the point $P$ lies somewhere on a plain $\cal{P}$ of such form. We don't suppose that adversary knows actual parameters of the plane. But it's enough for us to deduce that $\cal{P}$ intersects with another plane $\cal{H}$ (which ...

Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...