Cramer-Shoup Satisfies a Stronger Plaintext Awareness under a Weaker Assumption

摘要

In the seminal paper of Eurocrypt 2006, Dent defined a new assumption, simulatability, and showed that the well-known Cramer-Shoup public-key encryption scheme satisfied the weakest version of the plaintext awareness, the computational plaintext awareness, under the simulatability assumption, the DDH assumption, the DHK assumption, and the collision resistance of the hash function. However, a tricky aspect of the computational plaintext awareness was later shown. Moreover, the definition of the simulatability is elaborated. In this paper, we show that the Cramer-Shoup scheme satisfies a stronger variant of the plaintext awareness, the statistical plaintext awareness, under a weaker and simpler assumption than the simulatability. In particular, we show the statistical PA2-ness of the Cramer-Shoup scheme under computational assumptions.