Towards plaintext-aware public-key encryption without random oracles

Abstract

We consider the problem of defining and achieving plaintextaware encryption without random oracles in the classical public-key model. We provide definitions for a hierarchy of notions of increasing strength: PA0, PA1 and PA2, chosen so that PA1+IND-CPA -→ IND-CCA1 and PA2+IND-CPA -→ IND-CCA2. Towards achieving the new notions of plaintext awareness, we show that a scheme due to Damgård [12], denoted DEG, and the "lite"l version of the Cramer-Shoup scheme [11], denoted CS-Iite, are both PAO under the DHKO assumption of [12], and PA1 under an extension of this assumption called DHK1. As a result, DEG is the most efficient proven IND-CCA1 scheme known. © International Association for Cryptologic Research 2004.