Efficient KDM-CCA Secure Public-Key Encryption via Auxiliary-Input Authenticated Encryption

Abstract EN

KDM[F]-CCA security of public-key encryption (PKE) ensures the privacy of key-dependent messages f(sk) which are closely related to the secret key sk, where f∈F, even if the adversary is allowed to make decryption queries.

In this paper, we study the design of KDM-CCA secure PKE.

To this end, we develop a new primitive named Auxiliary-Input Authenticated Encryption (AIAE).

For AIAE, we introduce two related-key attack (RKA) security notions, including IND-RKA and weak-INT-RKA.

We present a generic construction of AIAE from tag-based hash proof system (HPS) and one-time secure authenticated encryption (AE) and give an instantiation of AIAE under the Decisional Diffie-Hellman (DDH) assumption.

Using AIAE as an essential building block, we give two constructions of efficient KDM-CCA secure PKE based on the DDH and the Decisional Composite Residuosity (DCR) assumptions.

Specifically, (i) our first PKE construction is the first one achieving KDM[Faff]-CCA security for the set of affine functions and compactness of ciphertexts simultaneously.

(ii) Our second PKE construction is the first one achieving KDM[Fpolyd]-CCA security for the set of polynomial functions and almost compactness of ciphertexts simultaneously.

Our PKE constructions are very efficient; in particular, they are pairing-free and NIZK-free.