a590003

• Key generation: On input 1 k sample two pairs of keys (sk 0 , pk 0 ) ← KeyGen(1 k ) and
(sk 1 , pk 1 ) ← KeyGen(1 k ). Then, for every i ∈ {0, . . . , t} sample crs (i) ← CRSGen (i) (1 k ).
Output the secret key sk = (sk 0 , sk 1 ) and the public key pk = ( pk 0 , pk 1 , crs (0) , . . . , crs (t)) .
• Encryption: On input a public key pk and a(
plaintext m, sample r 0 , r 1 ∈ {0, 1} ∗ uniformly
at random, and output the ciphertext c (0) = 0, c (0)
0 , c(0) 1
), , π(0) where
c (0)
0 = Enc pk0 (m; r 0 ) ,
c (0)
1 = Enc pk1 (m; r 1 ) ,
((
π (0) ← P (0) pk 0 , pk 1 , c (0)
0 , c(0) 1
)
, (m, r 0 , r 1 ) , crs (0)) .
• Homomorphic evaluation: On input a public key pk, a ciphertext
a function f ∈ F, proceed as follows. If i /∈ {0, . . . , t − 1} or
(
i, c (i)
0 , c(i) 1 , π(i) ), and
V (i) (( pk 0 , pk 1 , c (i)
0 , c(i) 1 , crs(i−1) , . . . , crs (0)) , π (i) , crs (i)) = 0
then output ⊥. Otherwise, output the ciphertext c (i+1) =
c (i+1)
0 = HomEval pk0
(
c (i)
0 , f )
c (i+1)
1 = HomEval pk1
(
c (i)
1 , f )
π (i+1) ← P (i+1) (( pk 0 , pk 1 , c (i+1)
0 , c (i+1)
1 , crs (i) , . . . , crs (0)) ,
,
,
(
i + 1, c (i+1)
0 , c (i+1)
1 , π (i+1) ), where
(
)
c (i)
0 , c(i) 1 , π(i) , f , crs (i+1)) .
• Decryption: On input a secret key sk and a ciphertext
{0, . . . , t} or
(
i, c (i)
0 , c(i) 1 , π(i) ), output ⊥ if i /∈
V (i) (( pk 0 , pk 1 , c (i)
0 , c(i) 1 , crs(i−1) , . . . , crs (0)) , π (i) , crs (i)) = 0 .
(
Otherwise, compute m 0 = Dec sk0
and otherwise output m 0 .
c (i)
0
)
(
and m 1 = Dec sk1
c (i)
1
Note that at any point in time a ciphertext of the scheme is of the form
)
. If m 0 ≠ m 1 then output ⊥,
(
i, c (i)
0 , c(i) 1 , π(i) ), where
i ∈ {0, . . . , t}, c (i)
0 and c (i)
1 are ciphertexts of the underlying encryption scheme, and π (i) is a proof
or an argument with respect to one of Π (0) , . . . , Π (t) . Note that the assumption that the argument
systems Π (1) , . . . , Π (t) are 1/4-succinct implies that the length of their arguments is upper bounded
by length of the proofs of Π (0) (i.e., l π (i) ≤ l π (0) for every i ∈ {1, . . . , t}). Thus, the only dependency
on t in the length of the ciphertext results from the ⌈log 2 (t + 1)⌉ bits describing the prefix i.
4.3 Chosen-Plaintext Security
We now prove that the construction offers targeted malleability against chosen-plaintext attacks.
For concreteness we focus on the case of a single message and a single ciphertext (i.e., the case
r(k) = q(k) = 1 in Definition 3.1), and note that the more general case is a straightforward
generalization. Given an adversary A = (A 1 , A 2 ) we construct a simulator S = (S 1 , S 2 ) as follows.
14
3. Targeted Malleability