<abstract xmlns="http://www.w3.org/1999/xhtml"><p> Fehr et al. (2010) proposed the first sender-equivocable encryption scheme secure against chosen-ciphertext attacks (NCCCA) and proved that NC-CCA security implies security against selective opening chosen-ciphertext attacks (SO-CCA). The NC-CCA security proof of the scheme relies on security against substitution attacks of a new primitive, the “crossauthentication code”. However, the security of the cross-authentication code cannot be guaranteed when all the keys used in the code are exposed. Our key observation is that, in the NC-CCA security game, the randomness used in the generation of the challenge ciphertext is exposed to the adversary. Based on this observation, we provide a security analysis of Fehr et al.’s scheme, showing that its NC-CCA security proof is flawed. We also point out that the scheme of Fehr et al. encrypting a single-bit plaintext can be refined to achieve NC-CCA security, free of the cross-authentication code. Furthermore, we propose the notion of “strong cross-authentication code”, apply it to Fehr et al.’s scheme, and show that the new version of the latter achieves NC-CCA security for multi-bit plaintexts.</p></abstract>

Fehr et al. (2010) proposed the first sender-equivocable encryption scheme secure against chosen-ciphertext attacks (NCCCA) and proved that NC-CCA security implies security against selective opening chosen-ciphertext attacks (SO-CCA). The NC-CCA security proof of the scheme relies on security against substitution attacks of a new primitive, the “crossauthentication code”. However, the security of the cross-authentication code cannot be guaranteed when all the keys used in the code are exposed. Our key observation is that, in the NC-CCA security game, the randomness used in the generation of the challenge ciphertext is exposed to the adversary. Based on this observation, we provide a security analysis of Fehr et al.’s scheme, showing that its NC-CCA security proof is flawed. We also point out that the scheme of Fehr et al. encrypting a single-bit plaintext can be refined to achieve NC-CCA security, free of the cross-authentication code. Furthermore, we propose the notion of “strong cross-authentication code”, apply it to Fehr et al.’s scheme, and show that the new version of the latter achieves NC-CCA security for multi-bit plaintexts.

Sender-equivocable encryption schemes secure against chosen-ciphertext attacks revisited

Department of Computer Science and Engineering, Shanghai Jiao Tong University 800 Dongchuan Road, Shanghai, 200240, China

College of Computer Science and Technology, Southwest University of Science and Technology 59 Qinglong Road, Mianyang, Sichuan, 621010, China

School of Science, Hangzhou Normal University 16 Xuelin Street, Xisha Higher Education Zone, Hangzhou, 310036, China

State Key Laboratory of Mathematical Engineering and Advanced Computing 30 Lianze Road, Building #18, Science and Education Industry Park, Binhu District,Wuxi, 214000, China

International Journal of Applied Mathematics and Computer Science

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.

Fehr et al. (2010) proposed the first sender-equivocable encryption scheme secure against chosen-ciphertext attacks (NCCCA) and proved that NC-CCA security...

Sender-equivocable encryption schemes secure against chosen-ciphertext attacks revisited

Published Online: Jun 25, 2015

Page range: 415 - 430

Received: Jan 03, 2014

DOI: https://doi.org/10.1515/amcs-2015-0032

© by Shengli Liu

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.