Paper 2024/1080
Separating Selective Opening Security From Standard Security, Assuming IO
Abstract
Assuming the hardness of LWE and the existence of IO, we construct a public-key encryption scheme that is IND-CCA secure but fails to satisfy even a weak notion of indistinguishability security with respect to selective opening attacks. Prior to our work, such a separation was known only from stronger assumptions such as differing inputs obfuscation (Hofheinz, Rao, and Wichs, PKC 2016). Central to our separation is a new hash family, which may be of independent interest. Specifically, for any $S(k) = k^{O(1)}$, any $n(k) = k^{O(1)}$, and any $m(k) = k^{\Theta(1)}$, we construct a hash family mapping $n(k)$ bits to $m(k)$ bits that is somewhere statistically correlation intractable (SS-CI) for all relations $R_k \subseteq \{0,1\}^{n(k)} \times \{0,1\}^{m(k)}$ that are enumerable by circuits of size $S(k)$. We give two constructions of such a hash family. Our first construction uses IO, and generically ``boosts'' any hash family that is SS-CI for the smaller class of functions that are computable by circuits of size $S(k)$. This weaker hash variant can be constructed based solely on LWE (Peikert and Shiehian, CRYPTO 2019). Our second construction is based on the existence of a circular secure FHE scheme, and follows the construction of Canetti et al. (STOC 2019).
Metadata
- Available format(s)
-
PDF
- Category
- Foundations
- Publication info
- Preprint.
- Keywords
- selective opening attackscorrelation intractability
- Contact author(s)
-
justin holmgren @ ntt-research com
bwaters @ cs utexas edu - History
- 2024-07-05: approved
- 2024-07-03: received
- See all versions
- Short URL
- https://ia.cr/2024/1080
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2024/1080, author = {Justin Holmgren and Brent Waters}, title = {Separating Selective Opening Security From Standard Security, Assuming {IO}}, howpublished = {Cryptology {ePrint} Archive, Paper 2024/1080}, year = {2024}, url = {https://eprint.iacr.org/2024/1080} }