International Association for Cryptologic Research

International Association
for Cryptologic Research


Paper: Relaxing Chosen-Ciphertext Security

Ran Canetti
Hugo Krawczyk
Jesper Nielsen
Search ePrint
Search Google
Abstract: Security against adaptive chosen ciphertext attacks (or, CCA security) has been accepted as the standard requirement from encryption schemes that need to withstand active attacks. In particular, it is regarded as the appropriate security notion for encryption schemes used as components within general protocols and applications. Indeed, CCA security was shown to suffice in a large variety of contexts. However, CCA security often appears to be somewhat {\em too strong:} there exist encryption schemes (some of which come up naturally in practice) that are not CCA secure, but seem sufficiently secure ``for most practical purposes.'' We propose a relaxed variant of CCA security, called {\sf Replayable CCA (RCCA)} security. RCCA security accepts as secure the non-CCA (yet arguably secure) schemes mentioned above; furthermore, it suffices for most existing applications of CCA security. We provide three formulations of RCCA security. The first one follows the spirit of semantic security and is formulated via an ideal functionality in the universally composable security framework. The other two are formulated following the indistinguishability and non-malleability approaches, respectively. We show that the three formulations are equivalent in most interesting cases.
  title={Relaxing Chosen-Ciphertext Security},
  booktitle={IACR Eprint archive},
  keywords={public-key cryptography /},
  note={An extended abstract of thiswork appears in the proceedings of Crypto 2003. 12283 received 19 Aug 2003},
  author={Ran Canetti and Hugo Krawczyk and Jesper Nielsen},