Efficient KDM-CCA Secure Public-Key Encryption via Auxiliary-Input Authenticated Encryption

Table 1

Comparison among PKE schemes achieving either KDM-CCA security or security against the set of polynomial functions. Here, we denote by the security parameter and by , , and the set of selection functions, the set of affine functions, and the set of polynomial functions of bounded degree , respectively. “CCA” indicates that the scheme is KDM-CCA secure. By the symbol “?”, we mean that the security proof is not rigorous. , , , , and are the underlying groups, where .

Scheme	Set	CCA?	Free of pairing?	The size of ciphertext	Assumption
BHHO08 [4] + CCS09 [11]			—		DDH
BGK11 [8]		—			DDH or LWE
MTY11 [10]		—			DCR
Hof13 [15]			—	+	DDH & DCR
LLJ15 [16]		?		+ +	DDH & DCR
Our scheme in Section 4				+ +	DDH & DCR
Our scheme in Section 5				+ +	DDH & DCR