HE ⇒ IND-CPA PKE

Fully-black-box reduction · standard model · folklore · security loss: none

Statement

Forgetting $\mathsf{Eval}$, a homomorphic encryption scheme $\mathsf{HE}=(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec},\mathsf{Eval})$ is an IND-CPA-secure public-key encryption scheme $(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec})$, with the same correctness and the same CPA advantage — folklore.

Notes

• If an HE scheme with two distinct messages of equal length exists, the identity map does not give IND-CCA2 security (No fixed-construction reduction from HE to IND-CCA2 Security) — standard. Without modification, additively homomorphic encryption schemes, for instance, are not IND-CCA2-secure — folklore. Nor does the identity map give IND-CCA1 security in general: a lunchtime attack recovers the key of Gentry’s basic scheme — LMSV11.