a590003

is defined as (state 1 , m 1 , . . . , m r , d 1 , . . . , d q ).
Definition 3.1. Let t = t(k) be a polynomial. A public-key encryption scheme Π = (KeyGen, Enc,
Dec, HomEval) is t-bounded non-malleable against chosen-plaintext attacks with respect to a set of
functions F if for any polynomials r = r(k) and q = q(k) and for any probabilistic polynomial-time
algorithm A = (A 1 , A 2 ) there exists a probabilistic polynomial-time algorithm S = (S 1 , S 2 ) such that
the distributions { Real CPA
Π,A,t,r,q (k)} k∈N and { Sim CPA
Π,S,t,r,q (k)} (see Figure 1) are computationally
k∈N
indistinguishable.
Real CPA
Π,A,t,r,q(k):
1. (sk, pk) ← KeyGen(1 k )
2. (M, state 1 , state 2 ) ← A 1 (1 k , pk)
3. (m 1 , . . . , m r ) ← M
4. c ∗ i ← Enc pk(m i ) for every i ∈ {1, . . . , r}
5. (c 1 , . . . , c q ) ← A 2 (1 k , c ∗ 1, . . . , c ∗ r, state 2 )
6. For every j ∈ {1, . . . , q} let
{ copyi if c
d j = j = c ∗ i
Dec sk (c j ) otherwise
7. Output (state 1 , m 1 , . . . , m r , d 1 , . . . , d q )
Sim CPA
Π,S,t,r,q(k):
1. (sk, pk) ← KeyGen(1 k )
2. (M, state 1 , state 2 ) ← S 1 (1 k , pk)
3. (m 1 , . . . , m r ) ← M
4. (c 1 , . . . , c q ) ← S 2 (1 k , state 2 )
5. For every j ∈ {1, . . . , q} let
⎧
copy i if c j = copy i
if c j = (i, f 1 , . . . , f l )
⎪⎨
where i ∈ {1, . . . , r},
d j = f(m i )
l ≤ t, f 1 , . . . , f l ∈ F,
and f = f 1 ◦ · · · ◦ f l
⎪⎩
Dec sk (c j ) otherwise
6. Output (state 1 , m 1 , . . . , m r , d 1 , . . . , d q )
Figure 1: The distributions Real CPA
Π,A,t,r,q(k) and Sim CPA
Π,S,t,r,q(k).
Dealing with multivariate functions. Our approach naturally generalizes to the case of multivariate
functions as follows. Fix a set F of functions that are defined on d-tuples of plaintexts for
some integer d, and let A be an efficient adversary that is given a sequence of ciphertexts c ∗ 1 , . . . , c∗ r
and outputs a sequence of ciphertexts c 1 , . . . , c q , as in Definition 3.1. Intuitively, for each output
ciphertext c j it should hold that either (1) Dec sk (c j ) is independent of c ∗ 1 , . . . , c∗ r, (2) c j = c ∗ i for
some i ∈ {1, . . . , r}, or (3) c j is obtained by repeatedly applying the homomorphic evaluation algorithm
using functions from the set F and a sequence of ciphertexts where each ciphertext is either
taken from c ∗ 1 , . . . , c∗ r or is independent of c ∗ 1 , . . . , c∗ r.
Formally, the distribution Real CPA
Π,A,t,r,q (k) is not modified, and the distribution SimCPA Π,S,t,r,q (k) is
modified by only changing the output c j = (i, f 1 , . . . , f l ) of S 2 to a d-ary tree of depth at most
t: each internal node contains a description of a function from the set F, and each leaf contains
either an index i ∈ {1, . . . , r} or a plaintext m. The corresponding value d j is then computed by
evaluating the tree bottom-up where each index i is replaced by the plaintext m i that was sampled
from M.
Dealing with randomized functions. The above definitions assume that F is a set of deterministic
functions. More generally, one can also consider randomized functions. There are two natural
11
3. Targeted Malleability