Abstract:The Key-Dependent Message (KDM) security requires that an encryption scheme remains secure, even if an adversary has access to encryptions of messages that depend on the secret key. In a multi-user surrounding, a key-dependent message can be any polynomial-time function f(sk1, sk2,..., skn) in the secret keys of the users. The Key-Dependent Message Chosen-Ciphertext (KDM-CCA2) security can be similarly defined if the adversary is also allowed to query a decryption oracle. To date, KDM security has been obtained by a few constructions. But most of them are limited f(sk1, sk2,..., skn) to affine functions. As to KDM-CCA2 security, there are only two constructions available. However, neither of them has comparable key sizes and reasonable efficiency, compared to the traditional KDM-free but CCA2 secure public key encryption schemes. This article defines a new function ensemble, and shows how to obtain KDM-CCA2 security with respect to this new ensemble from the traditional Cramer-Shoup (CS) cryptosystem. To obtain KDM security, the CS system has to be tailored for encryption of key-dependent messages. We present an efficient instantiation of the Cramer-Shoup public-key encryption (CS-PKE) scheme over the subgroup of quadratic residues in ℤp*, where p is a safe prime, and prove the CS-PKE to be KDM-CCA2 secure with respect to the new function ensemble. We show that our proposed ensemble covers some affine functions, as well as other functions that are not contained in the affine ensemble. At the same time, the CS-PKE scheme with respect to our proposed function ensemble finds immediate application to anonymous credential systems. Compared to other KDM-CCA2 secure proposals, the CS scheme is the most practical one due to its short ciphertext size and computational efficiency. © 2013 Springer-Verlag.

Tight Leakage-Resilient CCA-Security from Quasi-Adaptive Hash Proof System

Leakage-Flexible CCA-secure Public-Key Encryption: Simple Construction and Free of Pairing.

Efficient Chosen-Ciphertext Secure Public-Key Encryption Scheme with High Leakage-Resilience.

Strong Leakage and Tamper-Resilient PKE from Refined Hash Proof System.

Structure-preserving Public-Key Encryption with Leakage-Resilient CCA Security.

Public Key Cryptosystems Secure Against Memory Leakage Attacks

Public Key Encryption Resilient to Leakage and Tampering Attacks.

Efficient public key cryptosystem resilient to key leakage chosen ciphertext attacks

More Efficient Public-Key Cryptography with Leakage and Tamper Resilience.

Efficient KDM-CCA Secure Public-Key Encryption Via Auxiliary-Input Authenticated Encryption

URDP: General Framework for Direct CCA2 Security from any Lattice-Based PKE Scheme

Super-strong RKA Secure MAC, PKE and SE from Tag-Based Hash Proof System

Efficient Kdm-Cca Secure Public-Key Encryption for Polynomial Functions

Leakage-Resilient Anonymous Heterogeneous Multi-Receiver Hybrid Encryption in Heterogeneous Public-Key System Settings

Updatable Identity-Based Hash Proof System Based on Lattices and Its Application to Leakage-Resilient Public-Key Encryption Schemes.

Almost Tight Multi-user Security under Adaptive Corruptions from LWE in the Standard Model.

Leakage-Resilient Hybrid Signcryption in Heterogeneous Public-key Systems

Leakage-resilient / with optimal leakage rates from lattices

Key Encapsulation Mechanism with Tight Enhanced Security in the Multi-user Setting: Impossibility Result and Optimal Tightness

Key-Dependent Message Chosen-Ciphertext Security of the Cramer-Shoup Cryptosystem.

CCA2-secure Lattice-based Public Key Encryption with Equality Test in Standard Model