Efficient Key Dependent Message Security Amplification Against Chosen Ciphertext Attacks

Abstract

Applebaum (EUROCRYPT 2011) showed how to convert a public key encryption (PKE) scheme which is key dependent message (KDM) secure with respect to projection functions (also called projection-KDM secure) to a scheme which is KDM secure with respect to functions computable by polynomially bounded-size circuits (also called bounded-KDM secure). This result holds in both of the chosen plaintext attack (CPA) setting and the chosen ciphertext attack (CCA) setting. Bellare et al. (CCS 2012) later showed another conversion from a projection-KDM secure scheme to a bounded-KDM secure one, which is more efficient than Applebaum’s, but works only in the CPA setting. In this work, we show an efficient conversion from a projection-KDM-CCA secure PKE scheme to a bounded-KDM-CCA secure PKE scheme. To see that our conversion leads to more efficient bounded-KDM-CCA secure schemes than Applebaum’s, we show that by combining our result with several known results, we can obtain currently the most efficient bounded-KDM-CCA secure PKE scheme based on the symmetric external Diffie-Hellman (SXDH) assumption.

A How to Obtain a Projection-KDM-CCA Secure Scheme

In Sect. 4, we consider a projection-KDM-CCA secure scheme obtained from [12, 16] for the underlying scheme to which our KDM amplification method and that of Applebaum are applied. Here, we explain how this scheme is obtained in more details.

Recall that the BHHO scheme [12] is shown to be affine-KDM-CPA secure based on the decisional Diffie-Hellman (DDH) assumption. Let us write $\mathbb {G}$ to denote its underlying prime order group. We assume that $|\mathbb {G}| = O(\lambda )$, and that an element of $\mathbb {G}$ has size $O(\lambda )$ bits where $\lambda$ is a security parameter. Then, the plaintext space of this scheme is $\mathbb {G}$, and the secret key length is $p = 3 \log |\mathbb {G}| = O(\lambda )$. Moreover, since a ciphertext of the scheme consists of $(p+1)$ elements of $\mathbb {G}$, its size (for encrypting an element in $\mathbb {G}$) is $(p + 1) \cdot O(\lambda ) = O(\lambda ^2)$ bits.

Applebaum [3] showed how to obtain a projection-KDM-CPA secure scheme from the BHHO scheme: To the best of our knowledge, in Applebaum’s method, we have to “encode” each bit of a secret key as an element of $\mathbb {G}$. Furthermore, the BHHO scheme by itself can encrypt one group element, and thus if we use the encoding of a secret key, we only obtain a “single-bit output” projection-KDM-CPA secure scheme. Fortunately, he also showed how to construct a “$n$-bit output” projection-KDM-CPA secure scheme (with $n$-bit plaintext space) from a single-bit output projection-KDM-CPA secure scheme by just encrypting each bit of a plaintext and concatenating the resulting ciphertexts. Thus, in summary, from the BHHO scheme one can obtain a projection-KDM-CPA secure scheme with $n$-bit plaintext space whose ciphertext size is $O(n \lambda ^2)$ bits.

Camenisch, Chandran, and Shoup [15, 16] showed how to enhance a KDM-CPA secure scheme into a KDM-CCA secure scheme, using NIZK proofs. More precisely, they showed two approaches. The first approach obtains a KDM-CCA secure scheme from a KDM-CPA secure scheme, (non-KDM-)CCA secure scheme, a one-time signature scheme, and NIZK proofs (satisfying soundness and zero-knowledge). The second approach obtains a KDM-CCA secure scheme from a KDM-CPA secure scheme, (non-KDM-)CPA secure scheme, and simulation-sound NIZK proofs (also satisfying soundness and zero-knowledge).

We consider the KDM-CCA secure scheme obtained from the second approach. This is because in the first approach we have to use a (non-KDM-)CCA secure scheme that has the same plaintext space as the above mentioned BHHO-based projection-KDM-CPA secure scheme (i.e. $\mathbb {G}^n$ for $n$-bit plaintexts). However, it is not so easy to obtain a CCA secure scheme (that is compatible with the BHHO-based projection-KDM-CPA secure scheme) whose plaintext space can be flexibly chosen, independently of its public keys. (For example, the Cramer-Shoup scheme [18] has a disadvantage that its plaintext space is fixed once a public/secret key pair is generated.)

Fortunately, [15] showed how to convert the Groth-Sahai proof [19] so that it supports simulation soundness. More specifically, [15] showed how to convert the Groth-Sahai proof into the simulation-sound version by using a (non-simulation-sound) Groth-Sahai proof, (non-KDM-)CCA secure PKE scheme, and a one-time signature scheme. Although this conversion also requires a (non-KDM-)CCA secure scheme, it only needs to encrypt one group element. Therefore, it does not need to support a large plaintext space, and thus we can use the Cramer-Shoup scheme. According to [15], assuming the SXDH assumption in asymmetric bilinear groups, and assuming that the one-time signature scheme shown in [15] under the SXDH assumption is used, if we want to prove the membership of the “linear subspace” language, described by a system of $x$ linear equations with $y$ variables using the simulation-sound version of the Groth-Sahai proof, then the proof size becomes $O(x + y) \cdot O(\lambda ) = O((x+y)\lambda )$.

Now, we can construct a projection-KDM-CCA secure scheme that can encrypt $n$-bit plaintexts via the second method in [15] as follows: A plaintext is encrypted twice, by the KDM-CPA secure scheme and a (non-KDM-)CPA secure scheme (we use the ElGamal scheme), and then attach a “simulation-sound” Groth-Sahai NIZK proof that proves that the two ciphertexts encrypt a same plaintext. Note that the ciphertext size of the projection-KDM-CPA secure scheme is $O(n \lambda ^2)$ bits, and the ElGamal scheme (for encrypting $n$ group elements) has ciphertext size $O(n \lambda )$ bits. Furthermore, the equality of the plaintext by $n$-bit version of BHHO-based projection-KDM-CPA scheme and the plaintext of the ElGamal scheme, can be checked by $O(n \lambda )$ linear equations with $O(n)$ variables, and thus the proof size is $O(n \lambda ^2)$ bits. Therefore, in total, the resulting projection-KDM-CCA secure scheme for $n$-bit plaintexts, which is based on the SXDH assumption, has ciphertext size $O(n \lambda ^2)$.