DCR (safe-prime moduli) ⇒ CCA-secure PKE (Cramer–Shoup)

Fully-black-box reduction · standard model · CS02 · security loss: additive: twice the subset-membership advantage, which the DCR advantage bounds, plus statistical terms, one of them linear in the number of decryption queries

Statement

If DCR is hard for safe-prime moduli, $n=pq$ with $p=2p^{\prime }+1$ and $q=2q^{\prime }+1$, an IND-CCA2-secure public-key encryption scheme exists in the standard model. A universal hash proof system for a subset-membership problem in ${\mathbb{Z}}_{n^2}^{\ast }$ whose hardness is DCR gives the scheme, and no other primitive is needed; a hash function with suitable collision-resistance properties only improves its efficiency — CS02.

Notes

• The same paradigm gives IND-CCA2 encryption from QR, and the DDH-based Cramer–Shoup scheme is a special case of it — CS02.
• The DCR- and QR-based schemes of CS02 remain IND-CCA2-secure when the modulus is not a product of safe primes — HK12.