You are looking at a specific version 20120404:134622 of this paper. See the latest version.

Paper 2011/678

On definitions of selective opening security

Florian Böhl and Dennis Hofheinz and Daniel Kraschewski

Abstract

Assume that an adversary observes many ciphertexts, and may then ask for openings, i.e. the plaintext and the randomness used for encryption, of some of them. Do the unopened ciphertexts remain secure? There are several ways to formalize this question, and the ensuing security notions are not known to be implied by standard notions of encryption security. In this work, we relate the two existing flavors of selective opening security. Our main result is that indistinguishability-based selective opening security and simulation-based selective opening security do not imply each other. We show our claims by counterexamples. Concretely, we construct two public-key encryption schemes. One scheme is secure under selective openings in a simulation-based sense, but not in an indistinguishability-based sense. The other scheme is secure in an indistinguishability-based sense, but not in a simulation-based sense. Our results settle an open question of Bellare et al. (Eurocrypt 2009). Also, taken together with known results about selective opening secure encryption, we get an almost complete picture how the two flavors of selective opening security relate to standard security notions.

Metadata
Available format(s)
PDF
Category
Public-key cryptography
Publication info
Published elsewhere. Full version of PKC 2012 paper
Keywords
security definitionsselective opening securitypublic-key encryption
Contact author(s)
florian boehl @ kit edu
dennis hofheinz @ kit edu
daniel kraschewski @ kit edu
History
2013-10-29: last of 3 revisions
2011-12-18: received
See all versions
Short URL
https://ia.cr/2011/678
License
Creative Commons Attribution
CC BY
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.