KDM-CCA Security of the Cramer-Shoup Cryptosystem, Revisited

Jinyong Chang

1,2

and Rui Xue

State Key Laboratory of Information Security, Institute of Information Engineering,

Chinese Academy of Sciences, Minzhuang Road 89#, Beijing, China

Department of Mathematics, Changzhi University, Changzhi, China

Keywords:

Key-dependent Message Security, CCA Security, DDH Assumption, Public Key Encryption.

Abstract:

An encryption scheme is key-dependent message chosen plaintext attack (KDM-CPA) secure means that it

is secure even if an adversary obtains encryptions of messages that depend on the secret key. However,

there are not many schemes that are KDM-CPA secure, let alone key-dependent message chosen ciphertext

attack (KDM-CCA) secure. So far, only two general constructions, due to Camenisch, Chandran, and Shoup

(Eurocrypt 2009), and Hofheinz (Eurocrypt 2013), are known to be KDM-CCA secure in the standard model.

Another scheme, a concrete implementation, was recently proposed by Qin, Liu and Huang (ACISP 2013),

where a KDM-CCA secure scheme was obtained from the classic Cramer-Shoup (CS) cryptosystem w.r.t. a

new family of functions. In this paper, we revisit the KDM-CCA security of the CS-scheme and prove that, in

two-user case, the CS-scheme achieves KDM-CCA security w.r.t. richer ensembles, which covers the result of

Qin et al.. In addition, we present another proof about the result in (QLH13) by extending our approach used

in two-user case to n-user case, which achieves a tighter reduction to the decisional Difﬁe-Hellman (DDH)

assumption.

1 INTRODUCTION

Secure encryption is the most basic task in cryptog-

raphy, and signiﬁcant works have gone into deﬁning

and attaining it. Many commonly accepted deﬁni-

tions for secure encryption (GM84; RS91; RALS11)

assume that the plaintext messages to be encrypted

cannot depend on the secret decryption keys them-

selves. Over the last few years, it was observed that

in some situations the plaintext messages do depend

on the secret keys. Such situations may arise in hard-

disk encryption (BHHO08), computational soundness

results in formal methods (BRS02), or speciﬁc proto-

cols (CL01). Security in this more demanding setting

was termed KDM-CPA security (BRS02).

KDM-CPA security does not follow from stan-

dard security (CGH12), and there are indications

that KDM-CPA security (at least in its most general

form) cannot be proven using standard techniques

(BHHI10). For this reason, KDM-CPA security has

also received much attention in other settings, includ-

ing symmetric key encryption(BPS08), identity-based

encryption (GHV12).

A speciﬁc notion, called circular security, was deﬁned

by Camenisch and Lysyanskaya in (CL01).

In this paper, we mainly focus on the KDM secu-

rity in public key encryption (PKE) setting. There-

fore, ﬁrstly, let us recall the classic deﬁnition of

KDM-CPA security w.r.t. an efﬁciently computable

function ensemble F , proposed by Black et al. in

(BRS02). In particular, an adversary is given n pub-

lic keys pk

,··· , pk

and can access an oracle O that

upon receiving a query (i, f ), where f is a function

in F , and i ∈ [n] is an index, returns an encryption

of f (sk

,··· ,sk

) under the public key pk

. Then the

scheme is KDM-CPA secure w.r.t. F if the adversary

cannot distinguish between the oracle O and an ora-

cle O

that always returns an encryption of (say) the

(same length) all-zero string.

When considering an active adversary, we re-

quire a stronger form of KDM-CPA security, namely,

KDM-CCA security. In short, KDM-CCA security

requires the scheme is secure against an adversary

who has access to an additional decryption oracle.

Naturally, to avoid a trivial notion, the adversary is not

allowed to submit any of those given from encryption

oracle to its decryption oracle.

So far, only two general constructions, due to

Camenisch et al. (CCS09) and Hofheinz (H13),

are known to be KDM-CCA secure in the standard

299

Chang J. and Xue R..

KDM-CCA Security of the Cramer-Shoup Cryptosystem, Revisited.

DOI: 10.5220/0005048802990306

In Proceedings of the 11th International Conference on Security and Cryptography (SECRYPT-2014), pages 299-306

ISBN: 978-989-758-045-1

 2014 SCITEPRESS (Science and Technology Publications, Lda.)

model. In particular, Camenisch et al. showed that

a variation of the Naor-Yung paradigm (NY90) al-

lows one to obtain KDM-CCA security from any

KDM-CPA secure encryption scheme. In 2013,

Hofheinz constructed a KDM-CCA secure scheme

with compact ciphertexts w.r.t. selector functions

( f

(sk

,··· ,sk

) = sk

) using a new but intricate tool

named lossy algebraic ﬁlters. However, none of them

are competitive with current KDM-free but CCA-

secure schemes in terms of parameters and efﬁciency.

Temporarily putting the efﬁciency aside, we also

observe that, up to now, the existing KDM-CCA (even

KDM-CPA) secure schemes are usually limited to

afﬁne functions with some individual exceptions such

as (BHHI10; BGK11). Therefore, how to achieve

more KDM security beyond the afﬁne functions has

become an open problem.

Recently, in the excellent work of (QLH13), Qin

et al. proved that the tailored CS-scheme is KDM-

CCA secure w.r.t. a new function ensemble F (we

call QLH-ensemble) which covers some afﬁne func-

tions, as well as other functions that are not contained

in the afﬁne ensemble. Morever, compared to other

KDM-CCA secure proposals, Qin et al.’s scheme is

the most practical and efﬁcient one due to the efﬁ-

ciency of CS-scheme.

Then the following question arises naturally: Can

we ﬁnd other ensembles and prove that the CS-scheme

is also KDM-CCA secure w.r.t. these ensembles?

Our Motivation and Contribution. The argument

of this paper is motivated by those of (QLH13). We

revisit Qin et al.’s proof, and ﬁnd that they deﬁned a

speciﬁc ensemble (i.e. QLH-ensemble) and reduced

the KDM-CCA security w.r.t. QLH-ensemble to the

CCA security of the CS-scheme and, hence, (indi-

rectly) to the DDH assumption. In particular, in the

hybrid argument, assume that there exists a KDM-

CCA adversary A who has the “ability” to distinguish

the distributions of following ciphertexts:



··· ,Enc(pk

`−1

, f

`−1

),Enc(pk

, f

Enc(pk

`+1

| f

`+1

),···



and



··· ,Enc(pk

`−1

, f

`−1

),Enc(pk

| f

Enc(pk

`+1

| f

`+1

),···



where f

is the jth function queried by A. Then

they constructed an adversary A

who implements a

chosen-ciphertext attack on the CS-scheme using A

as a subroutine. Then our idea is that whether we

can directly reduce the KDM-CCA security to the

DDH assumption and hence obtain KDM-CCA se-

curity w.r.t. much richer ensembles. As a result, we

show that, in the two-user case, this conjecture is true.

On the other hand, in the original proof presented

by Qin et al., the simulator A

has to embed his public

key pk

∗

(obtained from his challenger) into the pub-

lic keys pk

,··· , pk

that will be given to A. There-

fore, he chooses randomly i

∗

∈ [n] and embeds pk

∗

into the i

∗

th position. He also “hopes” A will query

the encryption of f

under the public key pk

∗

so that

he can embed his challenge ciphertext. However, the

probability of i

∗

= i

equals 1/n. In other words, A

has only the probability of 1/n to successfully embed

his challenge. This results in their reduction to DDH

assumption much looser. Then, when extending the

technique used in two-user case to n-user case, we

also obtain a new proof of the result in (QLH13) with

a tighter reduction.

2 PRELIMINARIES

2.1 Decisional Difﬁe-Hellman (DDH)

Assumption

Let G be a group of prime order q and g be a ran-

dom generator. We let P

DDH

be the distribution

(g,g

) in G

where x,y are uniform in Z

. Let

DDH

be the distribution (g,g

) in G

, where

x,y,z are uniform in Z

Deﬁnition 1 (DDH Assumption). We say the deci-

sional Difﬁe-Hellman problem is hard over group G

if, for any probabilistic polynomial time (PPT) distin-

guisher D, there exists a negligible function negl(λ)

such that

Adv

DDH

G,D

(λ) := |Pr[r

←− P

DDH

: D(r) = 1]

− Pr[r

←− R

DDH

: D(r) = 1]| ≤ negl(λ).

Remark. Let p be a strong prime with p = 2q + 1,

where q is also a prime. If we let QR

be the sub-

group of quadratic residues in Z

∗

, then it is a cyclic

group with order q. It is widely believed that the DDH

assumption over QR

holds (CS02).

2.2 Target Collision-Resistant (TCR)

Hash Functions

A family of hash functions H = {H : D → R} is called

a TCR family, if for any PPT A, Adv

TCR

H ,A

(λ) is negli-

SECRYPT2014-InternationalConferenceonSecurityandCryptography

300

gible, where

Adv

TCR

H ,A

(λ) := Pr[x

←− D,H

←− H , y ← A(x,H) :

x 6= y ∧ H(x) = H(y)].

2.3 KDM-CCA Security

Now, we recall the formal deﬁnition of KDM-CCA

security of a public key encryption scheme P K E =

(Pars,Gen, Enc, Dec) proposed by Camenisch et al.

(CCS09). Let K be the space of secret keys of PK E.

For n = n(λ), let F = { f : K

→ M } be a set of func-

tions. We deﬁne the following experiment between a

challenger and an adversary A.

Exp

KDM-CCA

P K E,A

(λ,b):

1. Initialization Phase: The challenger runs

Pars(1

) to generate a public parameter pp and

then runs Gen(pp) n times to generate n key-pairs

(pk

,sk

), i ∈ [n]. It sends pp and the public keys

, i ∈ [n] to A. The challenger also initializes a

list CL :=

0 to an empty list.

2. Query Phase: A may adaptively query the chal-

lenger for two types of operations.

• Encryption Queries: The adversary selects

(i, f ) ∈ [n] × F and submits it to the challenger.

The challenger computes c = Enc(pp, pk

,m),

where m depends on the value of b. If

b = 0, then m = 0

| f (sk

,···,sk

, else m =

f (sk

,··· ,sk

). Then it appends (i,c) to CL.

Finally, the challenger sends c to the adversary.

• Decryption Queries: The adversary submits

a ciphertext c together with an index i ∈ [n]

to the challenger. If (i,c) ∈ CL, the chal-

lenger returns ⊥; otherwise returns the output

of Dec(pp,sk

,c).

3. Guess Phase: The adversary outputs a bit b

∈

{0,1}. Then the experiment also outputs b

Deﬁnition 2 (KDM-CCA). A public key encryption

scheme P K E is KDM-CCA secure w.r.t. F if for

any PPT adversary A, the advantage

Adv

KDM-CCA

P K E,A

(λ) :=



Pr[Exp

KDM-CCA

P K E,A

(λ,0) = 1]

− Pr[Exp

KDM-CCA

P K E,A

(λ,1) = 1]



is negligible.

2.4 New Function Ensembles

In this subsection, we propose a series of function en-

sembles which will be used for the KDM-CCA secu-

rity of the CS-scheme in later sections. Let q be a

prime. Let S be a ﬁnite set contained in Z

which,

in fact, will be corresponding to the secret key space

of CS-scheme. For any nonzero elements a

, we deﬁne an ensemble F

q,n

over S

. Formally,

let sk

= (x

) ∈ S, for 1 ≤ i ≤ n.

Each function f ∈ F

q,n

can be expressed as

f (sk

,··· ,sk

) =

∑

∏

i> j,i, j∈[n],s

∈{1,2}

[(x

i,s

+ a

j,s

)

i, j,t

·(y

i,s

j,s

)

i, j,t

·(z

i,s

j,s

)

i, j,t

] (mod q),

where α

∈ Z

, b

i, j,t

and b

i, j,t

∈ N.

Now, we present two special cases in order to il-

lustrate that our new function ensembles are properly

larger.

Case 1: For k ∈ {1, 2}, the functions x

,··· ,x

n−1,k

, (similarly, y

,··· ,y

n−1,k

, z

,··· ,z

n−1,k

) are all contained in F

n,q

It is clear that a PKE achieving KDM security

w.r.t. this ensemble has the so-called “all-or-nothing”

sharing property. Thus, it can also be used to discour-

age delegation of credentials in an anonymous cre-

dential system proposed by Camenisch and Lysyan-

skaya in (CL01).

On the other hand, if a

= a

= −1, then

the ensemble F

n,q

-1,-1,-1

essentially equals to the QLH-

ensemble (see Appendix). Therefore, our following

result, which states that the “tailored” Cramer-Shoup

scheme is KDM-CCA secure w.r.t. the series of en-

sembles, completely covers that of (QLH13) when the

number of users equals 2.

Case 2: When either the degrees b

i, j,t

, or b

i, j,t

is higher than 1, the new ensembles naturally contain

a great many of functions that do not belong to the

afﬁne function ensemble.

3 THE TAILORED CS-SCHEME

Note that the message space of CS-scheme is G of

order (prime) q, whereas the secret key space is Z

Therefore, we have to tailor the traditional CS-scheme

(i.e. encode the elements of Z

into elements of G).

In particular, we assume that there exist an efﬁcient

injective encoding encode : Z

→ G and a decoding

decode : G → Z

such that decode(encode(x)) = x

for all x ∈ Z

(CS02).

Now, we recall the tailored CS-scheme T C S =

(Pars,Gen, Enc, Dec) as follows (QLH13).

• Public Parameters Generation Pars(1

): Gen-

erate a group G with order q, where q is a λ-bits

prime. Choose g

←− G and H

←− H , where H

KDM-CCASecurityoftheCramer-ShoupCryptosystem,Revisited

301

is a TCR family from G

→ Z

. Output the public

parameter pp = (G,q,g

,H).

• Key Generation Gen(pp): Randomly choose

elements x

from Z

and com-

pute c = g

,d = g

,h = g

. Out-

put the public/private keys pair (pk,sk) =



(c,d, h), (x

)



• Encryption Enc(pp, pk,m): To encrypt a mes-

sage m ∈ Z

, one chooses r ∈ Z

at random. Then

compute

= g

,e = h

· encode(m), v = c

rα

where α = H(u

,e). Output the ciphertext C =

,e,v).

• Decryption Dec(pp,sk,C): Given a cipher-

text C = (u

,e,v), one runs as follows.

Compute α = H(u

,e), and check whether

= v. If not, output ⊥ and halt; else,

output m = decode(e/u

The correctness of the scheme can be veriﬁed easily.

About its security, we have the following theorem.

Theorem 1 ((CS02; QLH13)). If H is a family of

TCR hash functions and the DDH assumption holds

in QR

, then the tailored CS-scheme T C S is CCA

secure. More precisely, for any PPT adversary A, we

have

Adv

CCA

T C S,A

(λ) ≤ 2 · (Adv

DDH

(λ)

+ Adv

TCR

H ,B

(λ) +

+ 4)

where B

, B

are DDH-distinguisher and TCR-

adversary, respectively, and Q

is the number of A’s

decryption queries.

4 SECURITY PROOF

4.1 KDM-CCA Security (2-User Case)

Now we turn to the KDM-CCA security of the tai-

lored CS-scheme w.r.t. the ensembles we proposed.

We will note that it is instructive to treat the two-user

case. Therefore, ﬁrstly, we specially restate the en-

sembles F

q,n

in two-user case (i.e. F

q,2

) in

order to make our proof easy to understand. Actually,

each function f ∈ F

q,n

can also be considered as a

multivariate polynomial with the following six argu-

ments

+ a

Theorem 2. Let n = 2 and p be a safe prime number

with p = 2q +1. For any nonzero elements a

∈

, if H is a family of TCR hash functions, and the

DDH assumption holds in QR

, then the tailored CS-

scheme T C S described in Section 3 achieves KDM-

CCA security w.r.t. the ensemble F

q,2

. More pre-

cisely, for any PPT adversary A, there exist a DDH-

distinguisher B and a TCR-adversary B

, such that

Adv

KDM-CCA

T C S,A

(λ) ≤ Q · (Adv

DDH

(λ)

+ Adv

TCR

H ,B

(λ) +

q − Q

assuming that A makes at most Q queries to the en-

cryption oracle and Q

queries to the decryption ora-

cle.

Proof. Let A be any PPT adversary who implements

a key-dependent message chosen ciphertexts attack

on the tailored CS-scheme T C S . Let Q denote the

number of queries to the encryption oracle and Q

the

number of queries to the decryption oracle. We will

proceed in a sequence of games, each of which is a

modiﬁcation of the previous one. Let X

be the output

of A in Game

Game

: This game is the KDM-CCA security exper-

iment for b = 0. Therefore, we have

Pr[X

= 1] = Pr[Exp

KDM-CCA

T C S,A

(λ,0) = 1].

Game

(` = 1,···Q): This game is the same as

Game

`−1

except that the challenger responds the kth

encryption query (i

, f

) with



Enc(pp, pk

, f

(sk

,sk

)), k = 1, 2, · · · , `;

Enc(pp, pk

| f

(sk

,sk

), k = ` + 1,··· ,Q.

Obviously, Game

is the KDM-CCA security experi-

ment for b = 1 and

Pr[X

= 1] = Pr[Exp

KDM-CCA

T C S,A

(λ,1) = 1].

Thus,

Adv

KDM-CCA

T C S,A

(λ) = |Pr[Exp

KDM-CCA

T C S,A

(λ,0) = 1]

− Pr[Exp

KDM-CCA

T C S,A

(λ,1) = 1]|

= |Pr[X

= 1] − Pr[X

= 1]|

≤

∑

`=1



Pr[X

`−1

= 1] − Pr[X

= 1]



Next, we claim that, for any ` ∈ [Q], there exist two

suitable adversaries B and B

, who attack on the

DDH assumption and the TCR-security of H , respec-

tively, such that



Pr[X

`−1

= 1] − Pr[X

= 1]



≤Adv

DDH

(λ)

+ Adv

TCR

H ,B

(λ) +

q − Q

SECRYPT2014-InternationalConferenceonSecurityandCryptography

302

Then we have

Adv

KDM-CCA

T C S,A

(λ) ≤ Q ·



Adv

DDH

(λ)

+ Adv

TCR

H ,B

(λ) +

q − Q



Therefore, the KDM-CCA security of the tailored CS-

scheme T C S follows.

Finally, we turn to prove the above claim. In par-

ticular, for ` ∈ [Q], we construct an adversary B who

attacks on the DDH assumption over G(= QR

) us-

ing A as a subroutine.

In particular, when given (G, q) and a tuple

) coming from either the distribution

DDH

or R

DDH

, B randomly and independently

chooses

∈ Z

and computes

= g

Then pick H

←− H . Give pp = (G,q,g

,H),

= (c

), and pk

= (c

)

to A. Note that B knows the two secret

keys sk

= (x

), sk

). Therefore, he can compute

all the functions f of the secret keys and answer all

decryption queries from A as in the actual decryption

algorithms.

Next, we describe how to answer encryption

queries from A. For the kth encryption queries (i

, f

)

(without loss of generality, we assume that i

= 1), B

works as follows. Choose b

←− {0,1}.

• For k ∈ {1,··· , ` − 1}, compute C

Enc(pp, pk

, f

(sk

,sk

)) and return it to

• For k = `, compute

= u

· encode(m

and

= u

where α

= H(u

), and



| f

(sk

,sk

, if b = 0;

(sk

,sk

), if b = 1.

Let C

= (u

) and return it to A.

• For k ∈ {` + 1,··· ,Q}, compute C

Enc(pp, pk

| f

(sk

,sk

) and return it to

Finally, B stores (i

),··· , (i

) in the cipher-

text list CL. That completes the description of B.

Obviously, when the input (g

) of B

comes from P

DDH

, the output of the encryption oracle

is a legitimate ciphertext and B successfully simulates

Game

`−1

(when b = 0) or Game

(when b = 1) for A.

Next, we analyze A’s view when B’s input

) comes from R

DDH

. Let u

= g

and

= g

:= g

ωr

. We may assume that r

6= r

, since

this occurs except with negligible probability. In the

following, we call (u

) ∈ G

a valid cipher-

text if and only if log

= log

. Then the fact

that A’s view is essentially independent of the bit b

follows immediately from the following two claims.

Claim 1. If the decryption oracle rejects all invalid

ciphertexts during the attack, then the distribution of

the hidden bit b is independent of the adversary’s

view.

Proof of Claim 1. Consider the point Q = (z

) ∈

. If the decryption oracle rejects all invalid ci-

phertexts during the whole attack, then the adver-

sary A’s view consists of the public parameter pp =

(G,q,g

,H), the public keys pk

, pk

, the valid ci-

phertexts submitted to the decryption oracle and the

answers from it, and the answers from encryption or-

acle. In order to make our analysis clarity, we divide

it into the following three phases. In short, A may

obtain “more information” in the latter phase than the

former one.

• At the beginning of the attack, the adversary’s

view only consists of the public parameter pp =

(G,q,g

,H) and the public keys pk

, pk

Now, A can learn the following equations from

, pk



+ ωz

= log

+ ωz

= log

(1)

in which only one equation is related to Q:

+ ωz

= log

. (2)

Therefore, Q is a random point on the line (2).

• Next, we consider that the adversary A’s view

consists of the valid ciphertexts submitted to the

decryption oracle and the answers from it, except

for pp, pk

, and pk

. Since the decryption ora-

cle only answer valid ciphertexts (u

), A

only obtains the following equation that is linearly

dependent on (2):

+ r

ωz

= r

log

Hence, Q remains a random point on the line (2).

KDM-CCASecurityoftheCramer-ShoupCryptosystem,Revisited

303

• Finally, we inject the outputs (u

),··· ,

) of B’s encryption answers into

A’s view, where

= ε

· encode( f

(sk

,sk

)),

`−1

= ε

`−1

· encode( f

`−1

(sk

,sk

)),

= ε

· encode(m

`+1

= ε

`+1

· encode(0

| f

`+1

(sk

,sk

= ε

· encode(0

| f

(sk

,sk

for ε

= u

, j ∈ [Q]\{`}; ε

= u

, and



| f

(sk

,sk

, if b = 0;

(sk

,sk

), if b = 1.

Note that the items v

,··· ,v

is independent of

Q although they have relations to the secret keys

,sk

. Therefore, A can obtain (at most) the fol-

lowing equations from e

,··· ,e











(sk

,sk

) := a

(sk

,sk

) := a

(3)

According to the deﬁnition of the ensemble

q,2

, we know that the adversary can learn at

most the following two equations from (3):



+ a

:= a

+ a

:= a

(4)

Putting (1) and (4) together, A can distill











+ ωz

= log

+ ωz

= log

+ a

= a

+ a

= a

(5)

We can easily know that the coefﬁcient matrix of

(5) equals 3.

In addition, from ε

= u

, we have

+ ωr

= log

. (6)

Therefore, A obtains a new system of equations

composed by (5) and (6). Let A

be the coefﬁcient

matrix of the new system. Obviously, the rank of

equals 4 since r

6= r

Hence, the conditional distribution of ε

, condition-

ing on everything in the adversary’s view other than

, is uniform. It follows that b is independent of the

adversary’s view.

We still ignore the equations including x

i j

, for i, j ∈

{1,2}, since they are independent of the point Q.

Claim 2. The decryption oracle will reject all invalid

ciphertexts, except with negligible probability.

Proof of Claim 2. Now, we analyze the distribution

of P

= (x

) ∈ Z

, for i = 1,2, conditioned

on the adversary’s view. Without loss of generality,

we only consider the point P

. As in the proof of

Claim 1, at the beginning of the attack, the adver-

sary’s view consists of the public parameter pp =

(G,q,g

,H) and the public keys pk

= (c

and pk

= (c

). Hence, the adversary A learns

the following system:











+ ωx

= log

+ ωy

= log

+ ωx

= log

+ ωy

= log

(7)

After receiving the challenge ciphertexts (u

),··· , (u

) that are encrypted under

the public keys pk

,··· , pk

, respectively, A can also

get (at most) the following equations from e

,··· ,e











(sk

,sk

) = a

(sk

,sk

) = a

(8)

Getting rid of the equations from the system (8) that

are independent of P

, the adversary can distill (in

worst case) the equations:











+ a

:= a

+ a

:= a

+ a

:= a

+ a

:= a

(9)

In addition, he can also obtain (note that i

= 1)











+ ωr

+ α

ωr

= log

`−1

+ ωr

`−1

+ α

`−1

+α

`−1

ωr

`−1

= log

`−1

+ ωr

+ α

ωr

= log

`+1

+ ωr

`+1

+ α

`+1

+α

`+1

ωr

`+1

= log

`+1

+ ωr

+ α

+α

ωr

= log

(10)

from v

,··· ,v

, in which r

, for j ∈ [Q]\{`}, is the

randomness of the jth encryption. Since the equations

in (10) are linear combinations of those in (7), except

for

+ ωr

+ αr

+ αωr

= log

We also ignore the equations including z

i j

, i, j ∈ {1,2}

since they are independent of P

SECRYPT2014-InternationalConferenceonSecurityandCryptography

304

Combining all the equations listed in (7), (9), and (10)

that are “useful” for A to ﬁx the point P

, we have











+ ωx

= log

+ ωy

= log

+ ωx

= log

+ ωy

= log

+ a

:= a

+ a

:= a

+ a

:= a

+ a

:= a

+ ωr

+ αr

+ αωr

= log

(11)

It can be easily veriﬁed that the rank of coefﬁcient

matrix of (11) equals 7.

Now assume that A submits an invalid cipher-

text C

∗

:= (u

∗

) 6= (u

, e

), where

∗

= g

∗

= g

∗

, and r

∗

6= r

∗

. Let α

∗

H(u

∗

). We consider the following three

cases.

• (u

∗

) = (u

). Then α = α

∗

. But

∗

6= v

implies that C

∗

will certainly be rejected.

• (u

∗

) 6= (u

) and α

∗

= α. Then

a straightforward reduction to the TCR-property

of H implies that this case occurs with negligible

probability. That is, if we denote F be the event

that (u

∗

) 6= (u

) and α

∗

= α, then

we can easily construct an adversary B

satisfying

Pr[F] ≤ Adv

TCR

H ,B

(λ).

• (u

∗

) 6= (u

) and α

∗

6= α. In

this case, the decryption oracle will reject unless

∗

= v

∗

, i.e.

∗

+ ωr

∗

+ α

∗

+ α

∗

ωr

∗

= log

∗

(12)

Then the coefﬁcient matrix of the new sys-

tem formed by adding this equation into the

system (11) has rank of 8. Therefore, dif-

ferent values of v

∗

give different solutions for

). It follows that the adversary

guesses (x

) correctly with proba-

bility at most 1/q. Hence, the ﬁrst invalid ci-

phertext C

∗

is accepted with probability at most

1/q. Similarly, the ith invalid ciphertext is ac-

cepted with probability at most 1/(q − i + 1) ≤

1/(q − Q

), where Q

is the total number of de-

cryption queries. By the union bound, we know

that the decryption oracle rejects the ciphertext

∗

, except with (at most) negligible probability

/(q − Q

Combining the conclusions of Claim 1 with that

of Claim 2 completes the proof of the theorem.

4.2 KDM-CCA Security with a Tighter

Reduction (n-User Case)

In this subsection, we present a new proof of Qin et

al.’s result in (QLH13), which has the beneﬁt that our

new proof achieves a tighter reduction to the DDH

assumption than that of (QLH13). From a technol-

ogy perspective, we simply and straightly reduce the

KDM-CCA security of T CS to the DDH assumption,

using a similar analysis as in Theorem 2, instead of

Qin et al.’s approach that reduce the KDM security to

CCA security of the CS-scheme. Formally, we have

Theorem 3. Let p be a safe prime number with p =

2q + 1 and n be a polynomial of λ. If H is a family of

TCR hash functions, and the DDH assumption holds

in QR

, then the tailored CS-scheme T C S described

in Section 3 achieves KDM-CCA security w.r.t. the

QLH-ensemble (i.e. F

q,n

-1,-1,-1

) . More precisely, for any

PPT adversary A, there exist a DDH-distinguisher B

and a TCR-adversary B

, such that

Adv

KDM-CCA

T C S,A

(λ) ≤ Q ·



Adv

DDH

(λ)

+ Adv

TCR

H ,B

(λ) +

q − Q



assuming that A makes at most Q queries to the en-

cryption oracle and Q

queries to the decryption ora-

cle.

Since the main idea is completely analogous to

that of Theorem 2, we omit it here.

5 CONCLUSIONS

In this paper, we introduced a series of new function

ensembles and, in the two-user case, proved that the

tailored CS-scheme achieves the KDM-CCA security

w.r.t. the ensembles, which completely covers the re-

sult in (QLH13). As Qin et al. said in (QLH13),

though the new function ensembles do not cover all

the afﬁne functions, it sufﬁces for some applications

like the anonymous credential systems. Moreover, in

n-user case, we also give a new proof of the result in

(QLH13), which achieves a tighter reduction to the

DDH assumption.

ACKNOWLEDGEMENTS

The authors are grateful to anonymous reviewers for

many invaluable comments and suggestions. This

work is supported by National Natural Science Foun-

dation of China (No.61170280), the Strategic Priority

KDM-CCASecurityoftheCramer-ShoupCryptosystem,Revisited

305

Research Program of Chinese Academy of Sciences

(No.XDA06010701), and the Foundation of Institute

of Information Engineering for Cryptography.

REFERENCES

Backes, M., Pﬁtzmann, B., Scedrov, A. (2008). Key-

dependent message security under active attacks -

BRSIM/UC-soundness of dolev-yao-style encryption

with key cycles. Journal of Computer Security. Vol.

16(5), pp. 497-530.

Barak, B., Haitner, I., Hofheinz, D., Ishai, Y. (2010).

Bounded key-dependent message security. In EURO-

CRYPT’10. LNCS, vol. 6110, pp. 423-444. Springer,

Heidelberg.

Black, J., Rogaway, P., Shrimpton, T. (2002). Encryption-

scheme security in the presence of key-dependent

messages. In SAC’02. LNCS, vol. 2595, pp. 62-75.

Springer, Heidelberg.

Boneh, D., Halevi, S., Hamburg, M., Ostrovsky, R.

(2008). Circular-secure encryption from decision

Difﬁe-Hellman. In CRYPTO’08. LNCS, vol. 5157, pp.

108-125. Springer, Heidelberg.

Brakerski, Z., Goldwasser, S., Kalai, Y.T. (2011). Black-

box circular-secure encryption beyond afﬁne func-

tions. In TCC’11. LNCS, vol. 6597, pp. 201-218.

Springer, Heidelberg.

Camenisch, J., Chandran, N., Shoup, V. (2009). A public

key encryption scheme secure against key dependent

chosen plaintext and adaptive chosen ciphertext at-

tacks. In EUROCRYPT’09. LNCS, vol. 5479, pp. 351-

368. Springer, Heidelberg.

Camenisch, J., Lysyanskaya, A. (2001). An efﬁcient sys-

tem for non-transferable anonymous credentials with

optional anonymity revocation. In EUROCRYPT’01.

LNCS, vol. 2045, pp. 93-118. Springer, Heidelberg.

Cash, D., Green, M. and Hohenberger, S. (2012). New

deﬁnitions and separations for circular security. In

PKC’12. LNCS, vol. 7293, pp. 540-557. Springer,

Heidelberg.

Cramer, R., Shoup, V. (2002). Universal hash proofs and

a paradigm for adaptive chosen ciphertext secure

public-key encryption. In EUROCRYPT’02. LNCS,

vol. 2332, pp. 45-64. Springer, Heidelberg.

Galindo, D., Herranz, J., Villar, J. (2012). Identity-based en-

cryption with master keydependent message security

and leakage-resilience. In ESORICS’12. LNCS, vol.

7459, pp. 627-642. Springer, Heidelberg.

Goldwasser, S., Micali, S. (1984). Probabilistic encryption.

J. Comput. Syst. Science. Vol. 28(2), pp. 270-299.

Hofheinz, D. (2013). Circular chosen-ciphertext secu-

rity with compact ciphertexts. In EUROCRYPT’13.

LNCS, vol. 7881, pp. 520-536. Springer, Heidelberg.

Naor, M., Yung, M. (1990). Public-key cryptosystems

provably secure against chosen ciphertext attacks. In

STOC’90. pp. 427-437. ACM.

Qin, B., Liu, S., Huang, Z. (2013). Key-dependent message

chosen-ciphertext security of the Cramer-Shoup cryp-

tosystem. In ACISP’13. LNCS, vol. 7959, pp. 136-

151. Springer, Heidelberg.

Rackoff, C., Simon, D. (1992). Non-interactive zero-

knowledge proof of knowledge and chosen ciphertext

attack. In CRYPTO’91. LNCS, vol. 576, pp. 433-444.

Springer, Heidelberg.

Roman, R., Alcaraz Tello, C., Lopez, J., Sklavos, N. (2011).

Key management systems for sensor networks in the

context of the Internet of things. Computers & Elec-

trical Engineering. Vol. 37(2), pp. 147-159.

APPENDIX (QLH-Ensemble)

Let q be a prime number and X be a subset of Z

Then the QLH-function ensemble is a family of func-

tions F

q,n

:= { f : X

→ Z

} and each function f ∈

q,n

is deﬁned as

f (x

,··· ,x

) =

∑

∏

i6= j,i, j∈[n]

− x

)

i, j,t

mod q,

where α

∈ Z

and a

i, j,t

∈ N.

Speciﬁc to the tailored CS-scheme, we can repre-

sent functions from the QLH-ensemble as

f (sk

,··· ,sk

)

∑

∏

i> j,i, j∈[n],s

∈{1,2}

[(x

i,s

− x

j,s

)

i, j,t

· (y

i,s

− y

j,s

)

i, j,t

· (z

i,s

− z

j,s

)

i, j,t

] (mod q),

where sk

= (x

) is the secret key

for the ith user, α

∈ Z

, b

i, j,t

and b

i, j,t

∈

SECRYPT2014-InternationalConferenceonSecurityandCryptography

306