Cramer-Shoup and Practical CCA-Secure Encryption
Stub. Beyond CCA security's definition and OAEP (already covered): CCA security from trapdoor functions and CCA-secure ElGamal concretely instantiated with RSA; achieving CCA security from DDH without a random oracle via universal (and universal₂) projective hash functions, culminating in the Cramer-Shoup (ECS) scheme; a generic CCA transformation; CCA security with associated data; and practical padding-scheme case studies (PKCS1, Bleichenbacher's attack, OAEP+/SAEP) alongside private set intersection as a fun application.
Corresponds to Chapter 12 (CCA-security definitions, trapdoor permutations, and OAEP in the random oracle model are already covered in public-key-encryption-schemes). The chapter’s centerpiece is achieving CCA security without a random oracle, under the DDH assumption: universal and universal₂ projective hash functions are families of hash functions computable two ways (with a secret key, or with a public “projection” given the right witness), and plugging one into the right framework gives the Cramer-Shoup (ECS) encryption scheme — historically the first efficient CCA-secure public-key scheme with a full proof of security in the standard model. Also covers a generic (black-box) transformation achieving CCA security from weaker tools, CCA security with associated data, and the practical side: PKCS1 padding, Bleichenbacher’s attack on RSA-PKCS1 (a padding-oracle attack analogous to the CBC one seen elsewhere), and the improved OAEP+/SAEP+ padding schemes.
Outline (TODO — flesh out each)
- CCA security — ciphertext malleability, authentication, key escrow
- CCA-secure encryption from trapdoor function schemes (RSA instance)
- CCA-secure ElGamal encryption
- Universal and universal₂ projective hash functions
- The Cramer-Shoup (ECS) scheme
- CCA security via a generic transformation
- CCA-secure public-key encryption with associated data
- Case study: PKCS1, Bleichenbacher’s attack, OAEP+, SAEP
- Fun application: private set intersection