Abstract:For Key Encapsulation Mechanism (KEM) deployed in a multi-user setting, an adversary may corrupt some users to learn their secret keys, and obtain some encapsulated keys due to careless key managements of users. To resist such attacks, we formalize Enhanced security against Chosen Plaintext/Ciphertext Attack (ECPA/ECCA), which ask the pseudorandomness of unrevealed encapsulated keys under uncorrupted users. This enhanced security for KEM serves well for the security of a class of Authenticated Key Exchange protocols built from KEM. In this paper, we study the achievability of tight ECPA and ECCA security for KEM in the multi-user setting, and present an impossibility result and an optimal security loss factor that can be obtained. The existing meta-reduction technique due to Bader et al. (EUROCRYPT 2016) rules out some KEMs, but many well-known KEMs, e.g., Cramer-Shoup KEM (SIAM J. Comput. 2003), Kurosawa-Desmedt KEM (CRYPTO 2004), run out. To solve this problem, we develop a new technique tool named rank of KEM and a new secret key partitioning strategy for meta-reduction. With this new tool and new strategy, we prove that KEM schemes with polynomially-bounded ranks have no tight ECPA and ECCA security from non-interactive complexity assumptions, and the security loss is at least linear in the number n of users. This impossibility result covers lots of well-known KEMs, including the CramerShoup KEM, Kurosawa-Desmedt KEM and many others. Moreover, we show that the linear security loss is optimal by presenting concrete KEMs with security loss T(n). This is justified by a non-trivial security reduction with linear loss factor from ECPA/ECCA security to the traditional multi-challenge CPA/CCA security.

Efficient Signcryption Key Encapsulation without Random Oracles

Constructing practical signcryption KEM from standard assumptions without random oracles

Direct Construction of Signcryption Tag-KEM from Standard Assumptions in the Standard Model

A code-based hybrid signcryption scheme

Efficient Identity-Based Signcryption in the Standard Model

Sign-Then-Encrypt with Security Enhancement and Compressed Ciphertext

An Efficient Signcryption Scheme With Key Privacy

An Efficient Identity-Based Signcryption Scheme

Improved Efficiency of Kiltz07-KEM.

A Key Encapsulation Mechanism from Low Density Lattice Codes

Authenticated Key Exchange and Signatures with Tight Security in the Standard Model.

Key Encapsulation Mechanism with Tight Enhanced Security in the Multi-user Setting: Impossibility Result and Optimal Tightness

An Efficient Identity-Based Anonymous Signcryption Scheme

Efficient verifiably encrypted signature scheme without random oracles

Efficient Lattice-Based Signcryption in Standard Model

Tightly Sim-So-Cca Secure Public Key Encryption From Standard Assumptions

An Efficient Identity-Based Ring Signcryption Scheme without Random Oracles

Public Key Encryption Without Random Oracle Made Truly Practical

Efficient Multi-Pkg Id-Based Signcryption For Ad Hoc Networks

More Efficient Public-Key Cryptography with Leakage and Tamper Resilience.

A generic construction of identity-based signcryption