1. Compact CCA-Secure Encryption for Messages of Arbitrary Length Presentation By: D. Vamsi Krishna CS09B006

2. A NEW SCHEME [AKO07] 2/25 Ciphertext: Best CTO (as short as ElGamal’s) Can encrypt arbitrary message.

3. Details 3/25 Encryption: Key pair: Decryption: Hash:

4. ENCRYPTION (DIAGRAM) 4/25

5. DECRYPTION (DIAGRAM) 5/25

6. Comparison* SchemeKey- size (bits) ComputationOverh ead (bits) AssumptionLimitat ion EncryptionDecryption ElGamal3202 exp1 exp160DDHCPA Kurosawa- Desmedt +1920+1.2 exp, 1 mac 1.2 exp, 1 mac +240DDH, TCR- DHIES0+1 mac +80Oracle DDH (Gap-DH, ROM) - Kurosawa- Matsuo 0+SPRP 0Oracle DDH (Gap-DH, ROM) m > 80bits Boyen0+1 exp, 2 hash 0Gap-DH, ROMm > 80bits AKO070+0.2 exp, 1 hash +1 hash0Gap-DH, ROM- 6/25 Comparison in typical 80-bit security setting over elliptic curve group. 1 multi-base exponentiation is counted as 1.2 single-base exponentiation. Costs for trivial computations are ignored. Hashing a (potentially long) message is counted. * Personal Communication with Masayuki Abe

7. Security 7/25

8. CCA Attack The Challenger ( C ) generates a public key/secret key pair, and gives public key to Adversary (A). A makes a number of decryption queries to the challenger. A makes one challenge query !! A makes more decryption queries. A predicts a or b. A sends messages (a, b) to C, C chooses a or b at random, encrypts (d)and sends back He shouldn’t obviously ask for decryption of d

9. Proof Highlight Reduction to Gap-DH (outline) – Given, set public-key to set. – Simulate the decryption oracle by using gap-DH oracle. – Given challenge, set, define, return challenge ciphertext. – If A asks to H, then output the query. 9/25

10. Reference(s) Compact CCA-Secure Encryption for Messages of Arbitrary Length – Masayuki Abe, Eike Kiltz, Tatsuaki Okamoto Personal Communication with Masayuki Abe.