Tightly Secure Lossy Trapdoor Functions: Constructions and Applications

Box 2

The CCA-secure PKE scheme.

It runs , and , and then returns .

It runs and with branch ,

returns and .

: It first runs to obtain a one-time signature key pair . It then chooses

and , and computes

Finally, it returns .

: It first checks that . If not, it outputs . It then computes

and checks and ; if not, it outputs .

Finally, it outputs .