Cryptology ePrint Archive: Report 2016/880

Naor-Yung Paradigm with Shared Randomness and Applications

Silvio Biagioni and Daniel Masny and Daniele Venturi

Abstract: The Naor-Yung paradigm (Naor and Yung, STOC '90) allows to generically boost security under chosen-plaintext attacks (CPA) to security against chosen-ciphertext attacks (CCA) for public-key encryption (PKE) schemes. The main idea is to encrypt the plaintext twice (under independent public keys), and to append a non-interactive zero-knowledge (NIZK) proof that the two ciphertexts indeed encrypt the same message. Later work by Camenisch, Chandran, and Shoup (Eurocrypt '09) and Naor and Segev (Crypto '09 and SIAM J. Comput. '12) established that the very same techniques can also be used in the settings of key-dependent message (KDM) and key-leakage attacks (respectively).

In this paper we study the conditions under which the two ciphertexts in the Naor-Yung construction can share the same random coins. We find that this is possible, provided that the underlying PKE scheme meets an additional simple property. The motivation for re-using the same random coins is that this allows to design much more efficient NIZK proofs. We showcase such an improvement in the random oracle model, under standard complexity assumptions including Decisional Diffie-Hellman, Quadratic Residuosity, and Subset Sum. The length of the resulting ciphertexts is reduced by 50\%, yielding truly efficient PKE schemes achieving CCA security under KDM and key-leakage attacks.

As an additional contribution, we design the first PKE scheme whose CPA security under KDM attacks can be directly reduced to (low-density instances of) the Subset Sum assumption. The scheme supports key-dependent messages computed via any affine function of the secret key.

Category / Keywords: public-key cryptography / Naor-Yung paradigm, KDM security, leakage, Subset Sum

Original Publication (with major differences): SCN 2016

Date: received 7 Sep 2016, last revised 25 Jun 2017

Contact author: daniele venturi at unitn it

Available format(s): PDF | BibTeX Citation

Note: Minor revision. Full version published in Theoretical Computer Science.

Version: 20170625:214746 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]