No shielding black-box reduction from CPA-secure PKE to CCA1-secure PKE

Unconditional · GMM07

Statement

There is no black-box construction of an IND-CCA1-secure PKE scheme, and hence none of an IND-CCA2-secure one, from an IND-CPA-secure one in which the new decryption algorithm does not call the old encryption algorithm, a restriction called shielding — GMM07.

Notes

• Non-shielding constructions evade the barrier’s technique: the black-box construction of multi-bit from one-bit IND-CCA2-secure encryption is non-shielding, its decryption calling the underlying encryption algorithm — MS09.
• Bounded-query chosen-ciphertext security, against a fixed polynomial number of decryption queries, does follow from IND-CPA security by a black-box construction — CHH+07.
• Non-black-box constructions from CPA-secure PKE and NIZK proofs exist, of IND-CCA1 — NY90 — and of IND-CCA2 security — DDN91, Sah99.
• Whether IND-CPA-secure PKE alone yields IND-CCA1 or IND-CCA2 security by any construction is open — standard.