Cryptology ePrint Archive: Report 2003/174

Relaxing Chosen-Ciphertext Security

Ran Canetti and Hugo Krawczyk and Jesper Nielsen

Abstract: Security against adaptive chosen ciphertext attacks (or, CCA security) has been accepted as the standard requirement from encryption schemes that need to withstand active attacks. In particular, it is regarded as the appropriate security notion for encryption schemes used as components within general protocols and applications. Indeed, CCA security was shown to suffice in a large variety of contexts. However, CCA security often appears to be somewhat {\em too strong:} there exist encryption schemes (some of which come up naturally in practice) that are not CCA secure, but seem sufficiently secure ``for most practical purposes.''

We propose a relaxed variant of CCA security, called {\sf Replayable CCA (RCCA)} security. RCCA security accepts as secure the non-CCA (yet arguably secure) schemes mentioned above; furthermore, it suffices for most existing applications of CCA security. We provide three formulations of RCCA security. The first one follows the spirit of semantic security and is formulated via an ideal functionality in the universally composable security framework. The other two are formulated following the indistinguishability and non-malleability approaches, respectively. We show that the three formulations are equivalent in most interesting cases.

Category / Keywords: public-key cryptography /

Publication Info: An extended abstract of thiswork appears in the proceedings of Crypto 2003.

Date: received 19 Aug 2003

Contact author: canetti at us ibm com

Available format(s): Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

Version: 20030819:195126 (All versions of this report)

Short URL: ia.cr/2003/174

Discussion forum: Show discussion | Start new discussion