a590003

algorithm S 2 invokes the knowledge extractor Ext (A2 ,Ext A2 ) that corresponds to the combination of
(
)
A 2 and Ext A2 to obtain a witness c (i−2)
0 , c (i−2)
1 , π (i−2) , f (i−2) to the fact that
(
pk 0 , pk 1 , c (i−1)
0 , c (i−1)
1 , crs (i−2) , . . . , crs (0)) ∈ L (i−1) ,
and so on for i iterations or until the first failure.
Having described the simulator we now prove the following theorem stating the security of the
scheme in the case r(k) = q(k) = 1 (noting again that the more general case is a straightforward
generalization). As discussed in Section 2.2, the quadratic blow-up in the length of the commonreference
string in Groth’s argument system [Gro10] restricts our treatment here to a constant
number t of repeated homomorphic operations, and any improvement to Groth’s argument system
with a common-reference string of linear length will directly allow any logarithmic number of
repeated homomorphic operations (and any polynomial number of such operations in the scheme
presented in Section 5).
Theorem 4.1. For any constant t ∈ N and for any probabilistic polynomial-time adversary A the
distributions {Real CPA
Π ′ ,A,t,r,q (k)} k∈N and {Sim CPA
Π ′ ,S,t,r,q (k)} k∈N are computationally indistinguishable,
for r(k) = q(k) = 1.
Proof. We define a sequence of distributions D 1 , . . . , D 7 such that D 1 = Sim CPA
Π ′ ,S,t,r,q and D 7 =
Real CPA
Π ′ ,A,t,r,q , and prove that for every i ∈ {1, . . . , 6} the distributions D i and D i+1 are computationally
indistinguishable. For simplicity in what follows we assume that the scheme Π =
(KeyGen, Enc, Dec, HomEval) actually has perfect decryption for all keys (and not with an overwhelming
probability over the choice of keys). This assumption clearly does not hurt any of the
indistinguishability arguments in our proof, since we can initially condition on the event that both
(sk 0 , pk 0 ) and (sk 1 , pk 1 ) provide perfect decryption.
The distribution D 1 . This is the distribution Sim CPA
Π ′ ,S,t,r,q .
The distribution D 2 . This distribution is obtained from D 1 via the following modification. As
in D 1 , if S 2 fails to obtain a certification chain, then output (state 1 , m, ⊥). Otherwise, the
output is computed as follows:
1. If c (0) = c ∗ and i = 0 then output (state 1 , m, copy 1 ). This is identical to D 1 .
2. If c (0) = c ∗ and i > 0 then output (state 1 , m, f(m)), where f = f (0) ◦ · · · ◦ f (i−1) . This
is identical to D 1 .
3. If c (0) ≠ c ∗ then compute the message m (0) = Dec ′ sk (c(0) ). If m (0) ≠ ⊥ then output
(
state1 , m, f ( m (0))) , where f = f (0) ◦ · · · ◦ f (i−1) , and otherwise output (state 1 , m, ⊥).
That is, in this case instead of invoking the decryption algorithm Dec ′ on c (i) , we invoke
it on c (0) , and then apply the functions given by the certification chain.
The distribution D 3 . This distribution is obtained from D 2 by producing crs (0) and π ∗ (where
c ∗ = (c ∗ 0 , c∗ 1 , π∗ )) using the simulator of the NIZK proof system Π (0) .
The distribution D 4 . This distribution is obtained from D 3 by producing the challenge ciphertext
c ∗ = (c ∗ 0 , c∗ 1 , π∗ ) with c ∗ 0 = Enc pk 0
(m) (instead of c ∗ 0 = Enc pk 0
(m ′ ) as in D 3 ).
The distribution D 5 . This distribution is obtained from D 4 by producing the challenge ciphertext
c ∗ = (c ∗ 0 , c∗ 1 , π∗ ) with c ∗ 1 = Enc pk 1
(m) (instead of c ∗ 1 = Enc pk 1
(m ′ ) as in D 4 ).
16
3. Targeted Malleability