The Cramer-Shoup Encryption Scheme Is Plaintext Aware in the Standard Model
Lecture notes in computer sciencePublished 1 January 2006
Alexander W. Dent
Citations56
SJR quartileQ2
SJR score0.35
SNIP0.55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
The notion of plaintext awareness as it applies to hybrid encryption schemes is examined and it is deduced that the Cramer-Shoup scheme is plaintext-aware in the standard model, answering a previously open conjecture of Bellare and Palacio on the existence of fully plain Text Aware encryption schemes.
Abstract
In this paper we examine the notion of plaintext awareness as it applies to hybrid encryption schemes. We apply this theory to the Cramer-Shoup hybrid scheme acting on fixed length messages and deduce that the Cramer-Shoup scheme is plaintext-aware in the standard model. This answers a previously open conjecture of Bellare and Palacio on the existence of fully plaintext-aware encryption schemes.
Keywords
Computer ScienceEngineering
SIAM Journal on ComputingDesign and Analysis of Practical Public-Key Encryption Schemes Secure against Adaptive Chosen Ciphertext Attack
977 Citations2003Ronald Cramer, Victor Shoup
A new public-key encryption scheme, along with several variants, is proposed and analyzed that appear to be the first public- key encryption schemes in the literature that are simultaneously practical and provably secure.
A concrete security treatment of symmetric encryption
912 Citations2002Mihir Bellare, Anand Desai +2 more
This work studies notions and schemes for symmetric (ie. private key) encryption in a concrete security framework and gives four different notions of security against chosen plaintext attack, providing both upper and lower bounds, and obtaining tight relations.
Lecture notes in computer scienceOptimal asymmetric encryption
890 Citations1995Mihir Bellare, Phillip Rogaway
A slightly enhanced scheme is shown to have the property that the adversary can create ciphertexts only of strings for which she “knows” the corresponding plaintexts—such a scheme is not only semantically secure but also non-malleable and secure against chosen-ciphertext attack.
Lecture notes in computer scienceRelations among notions of security for public-key encryption schemes
791 Citations1998Mihir Bellare, Anand Desai +2 more
The goals of privacy and non-malleability are considered, each under chosen plaintext attack and two kinds of chosen ciphertext attack, and a new definition of non-Malleability is proposed which the author believes is simpler than the previous one.
Lecture notes in computer scienceHMQV: A High-Performance Secure Diffie-Hellman Protocol
714 Citations2005Hugo Krawczyk
HMQV is presented, a carefully designed variant of MQV that provides the same superb performance and functionality of the original protocol but for which all the MqV's security goals can be formally proved to hold in the random oracle model under the computational Diffie-Hellman assumption.
Lecture notes in computer scienceTowards Practical Public Key Systems Secure Against Chosen Ciphertext attacks
352 Citations2007Ivan Damgård
Two efficient constructions aimed at making public key systems secure against chosen ciphertext attacks are presented and a connection between such public-key systems and efficient identification schemes is pointed out.
Lecture notes in computer scienceOn Cryptographic Assumptions and Challenges
349 Citations2003Moni Naor
This work proposes several open problems regarding cryptographic tasks that currently do not have a good challenge of that sort by creating a challenge to their validity by classifying computational assumptions based on the complexity of falsifying them.
Lecture notes in computer scienceOAEP Reconsidered
296 Citations2001Victor Shoup
It turns out-- essentially by accident, rather than by design--that RSA-OAEP is secure in the random oracle model; however, this fact relies on special algebraic properties of the RSA function, and not on the security of the general OAEP scheme.
Lecture notes in computer scienceThe Knowledge-of-Exponent Assumptions and 3-Round Zero-Knowledge Protocols
235 Citations2004Mihir Bellare, Adriana Palacio
It is shown that it is possible to “falsify” assumptions like KEA2 that, due to their nature and quantifier-structure, do not lend themselves easily to "efficient falsification" (Naor [15]).
Lecture notes in computer scienceRSA-OAEP Is Secure under the RSA Assumption
201 Citations2001Eiichiro Fujisaki, Tatsuaki Okamoto +2 more
Lecture notes in computer scienceOn the existence of 3-round zero-knowledge protocols
177 Citations1998Satoshi Hada, Toshiaki Tanaka
This paper constructs a 3-round zero-knowledge protocol for any NP language based on a novel computational assumption related to the Diffie-Hellman problem and achieves a weaker notion of zero- Knowledge: auxiliary-input non-uniform zero- knowledge.
Journal of CryptologyCBC MAC for Real-Time Data Sources
144 Citations2000Erez Petrank, Charles Rackoff
A rigorous proof that the basic CBC MAC is secure when applied to a prefix-free message space is argued, which is virtually as simple and as efficient as computing the standard CBC MAC on the message.
Lecture notes in computer scienceTowards Plaintext-Aware Public-Key Encryption Without Random Oracles
141 Citations2004Mihir Bellare, Adriana Palacio
The problem of defining and achieving plaintext-aware encryption without random oracles in the classical public-key model is considered, and it is shown that a scheme due to Damgard, denoted DEG, and the lite version of the Cramer-Shoup scheme are both PA0 under the DHKO assumption of [12], and PA1 under an extension of this assumption called DHK1.
Lecture notes in computer scienceA Key Encapsulation Mechanism for NTRU
8 Citations2005Martijn Stam
The KEM is more efficient than a naive approach based on NAEP and resistant against the decryption failures that may occur when using NTRU and introduced plaintext awareness for KEMs.