Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [cramer-shoup]

Cramer-Shoup asymmetric encryption (an extension of ElGamal)

The Cramer-Shoup cryptosystem is an asymmetric encryption algorithm. Its security relies on the decisional Diffie-Hellman assumption. It is an extension of ElGamal with a one-way hash function to ensure non-malleability .

12 questions
6
votes
2 answers

Does Cramer-Shoup allow re-randomization?

Is it possible to re-randomize a ciphertext with the Cramer-Shoup System? I have some Cramer-Shoup ciphertexts and i want to re-randomize them, so they look different and are unlinkable to there previous form, but still can be decrypted with the…
Crypto Muck
  • 63
  • 3
4
votes
1 answer

Why is the lite version of Cramer-Shoup not IND-CCA2 secure?

In the lite version of Cramer-Shoup we have a group $G$ with generators $g_1$ and $g_2$, private key $a_1, a_2, b_1, b_2$, and public key $A = g_1^{a_1} g_2^{a_2}$, $B = g_1^{b_1} g_2^{b_2}$. Encryption works by picking a random integer $r$ and…
dkaeae
  • 580
  • 5
  • 16
2
votes
1 answer

Is Cramer-Shoup Lite IND-CCA secure?

Recently, I studied about Cramer-Shoup encryption scheme. Then, I read a book which mentioned a simpler version of this scheme, the Cramer-Shoup Lite encryption scheme. I was wondering if there is somewhere a formal proof of IND-CCA security of…
user178592
  • 41
  • 4
2
votes
0 answers

Intuition for Cramer Shoup Encryption Scheme?

I was reading the Cramer Shoup CCA2 secure encryption scheme. The scheme is as follows. Public key = $(g_1, g_2, c, d, h, hk)$, where $c = g_1^{x_1}g_2^{y_1}$, $d = g_1^{x_2}g_2^{y_2}$, $h = g_1^z$, hk is hash key of a universal one-way hash…
satya
  • 1,484
  • 10
  • 32
2
votes
1 answer

Is Cramer-Shoup backdoorable?

We recently had the question whether it's possible to have multiple private keys with one public key for the cramer-shoup cryptosystem. There it was stated that finding such "secondary" private keys is possible if $log_{g_1}(g_2) \bmod q$ is known.…
SEJPM
  • 46,697
  • 9
  • 103
  • 214
1
vote
1 answer

ECCS: Elliptic Curve Cryptography Cramer Shoup

Introduction I know how to do Cramer-Shoup with cyclic groups. But how do I do it in elliptic curve cryptography (ECC)? Cramer-Shoup with cyclic groups Following was taken from Wikipedia:…
MathNewbie
  • 11
  • 1
1
vote
1 answer

Knowledge of discrete log is needed in the proof of Cramer-Shoup public key scheme?

In the proof of the Cramer-Shoup public key scheme [1], I understand that the adversary's view can be seen as equations such as $\log c = x_1 + w x_2, \log d = y_1 + w y_2$ and so on (equation 1 and 2 in [1]), where $\log = \log_{g_1}$ and $w = \log…
lamba
  • 1,395
  • 8
  • 18
1
vote
1 answer

Key construction in the Full Cramer-Shoup cryptosystem

The Full Cramer-Shoup Encryption scheme needs to choose six random numbers from $\mathbb{Z}_q$, which we denote them by $ x_1,x_2,y_1,y_2,z_1,z_2 $. Then the scheme hides these random numbers in the values $c=g_1^{x{1}}g_2^{x{2}}$,…
user13076
  • 35
  • 1
0
votes
1 answer

Issues generating keys/cyclic group for Cramer-Shoup Cryptosystem with OpenSSL

I'm trying to implement a Cramer Shoup cryptography system in C but I've run into problems with generating the keys. From what I have found on the wiki and in other papers, to generate keys for Cramer Shoup you must generate a cyclic group G of…
KoiNip
  • 21
  • 2
0
votes
1 answer

What's the proper way of fitting hash digest to encryption scheme?

I would like to know what is the proper way of fitting the hash digest to the prime in which the encryption scheme operates. regardless if the bits of the hash digest is larger or smaller than the prime. I've read that the Cramer-Shoup uses a…
Kelen Nihomori
  • 27
  • 3
0
votes
1 answer

Can a Cramer-Shoup public key have two different private keys?

Since I am new to the Cramer-Shoup algorithm, I would like to know: Is it possible to have two different private keys for a public key due the key pair generation algorithm that Cramer-Shoup uses? I know that in public key algorithms, this is not…
Бассел Жаббор
  • 119
  • 1
  • 5
0
votes
0 answers

Distribution of the Cramer-Shoup keys, if $g_2$ is not a generator

Let $G=\langle g_1 \rangle =\langle g_2 \rangle$ be a cyclic group of prime order $q$ and $H$ be an universal OW hash function. Consider the Cramer-Shoup scheme $\Pi=(\sf KG,Enc,Dec)$, where we recall the key generation algorithm: Algorithm $\sf…
Chris
  • 266
  • 2
  • 11