Public-Key Encryptions Tolerating Adaptive and Composable Adversaries

Huafei Zhu, Tadashi Araragi, Takashi Nishide +1 more

Ananth Raghunathan, Gil Segev, Salil Vadhan

Ananth Raghunathan, Gil Segev, Salil Vadhan

Ran Canetti, Shai Halevi, Jonathan I. Katz

Huafei Zhu

In this paper, a new construction of adaptive and composable transcoders from universally composabley secure (the uc-security) commitments is introduced and analyzed. Our transcoder is built on the top of scalable video coding standard, known as H.264/SVC. The idea behind of our implementation is simple: a base layer of streams is encoded by an extractable key while an enhanced layer of streams is encoded by an equivocable key of the underlying universally composable commitment scheme. We show that our construction reaches the UC-security in the presence of adaptive adversaries in the common reference string model assuming that the underlying Paillier's public-key encryption scheme is semantically secure and the Damgård-Fazio-Nicolosi's non-interactive protocol is zero-knowledge in the registered public-key model. Furthermore, if the underlying Paillier's public-key encryption scheme is replaced by Damgård-Jurik's length-flexible public key encryption scheme, then the derived adaptive and composable transcoder is length-flexible as well.

Ananth Raghunathan, Gil Segev, Salil Vadhan

Bellare, Boldyreva, and O’Neill (CRYPTO ’07) initiated the study of deterministic public-key encryption as an alternative in scenarios where randomized encryption has inherent drawbacks. Theresultinglineofresearchhassofarguaranteedsecurityonlyforadversarially-chosenplaintext distributions that are independent of the public key used by the scheme. In most scenarios, however, it is typically not realistic to assume that adversaries do not take the public key into account when attacking a scheme. We show that it is possible to guarantee meaningful security even for plaintext distributions that depend on the public key. We extend the previously proposed notions of security, allowing adversaries to adaptively choose plaintext distributions after seeing the public key, in an interactive manner. The onlyrestrictionswemakearethat: (1) plaintextdistributionsareunpredictable (as is essential in deterministic public-key encryption), and (2) the number of plaintext distributions from which each adversary is allowed to adaptively choose is upper bounded by 2 p, where p can be any predetermined polynomial in the security parameter. For example, with p = 0 we capture plaintext distributions that are independent of the public key, and with p = O(slogs)