a590003

The distribution D 6 . This distribution is obtained from D 5 by producing crs (0) and π ∗ (where
c ∗ = (c ∗ 0 , c∗ 1 , π∗ )) using the algorithms CRSGen (0) and P (0) , respectively (and not by using the
simulator of the NIZK proof system Π (0) as in D 5 ).
The distribution D 7 . This is the distribution Real CPA
Π ′ ,A,t,r,q .
Before proving that the above distributions are computationally indistinguishable, we first prove
that S 2 fails to produce a certification chain with all but a negligible probability.
Lemma 4.2. In distributions D 1 , . . . , D 6 , whenever A 2 outputs a valid ciphertext, S 2 generates a
certification chain with all but a negligible probability.
Proof. Assume towards a contradictions that in one of D 1 , . . . , D 6 with a non-negligible probability
it holds that A 2 outputs a valid ciphertext but S 2 fails to generate a certification chain. In particular,
there exists an index i ∈ {1, .(
. . , t} for which with a non-negligible probability A 2 outputs a valid
ciphertext of the form c (i) = i, c (i)
0 , c(i) 1
), , π(i) but S 2 fails to generate a certification chain. Recall
that for generating a certification chain starting with c (i) , the simulator S 2 attempts to invoke
i knowledge extractors (until the first failure occurs) that we denote by Ext (i) , . . . , Ext (1) . These
knowledge extractors correspond to the malicious provers described in the description of S 2 for the
argument systems Π (i) , . . . , Π (1) , respectively. Then, there exists an index j ∈ {1, . . . , i} for which
with a non-negligible probability S 2 is successful with Ext (i) , . . . , Ext (j+1) but fails with Ext (j) .
( The fact that S 2 is successful with Ext (j+1) implies that it produces a valid ciphertext c (j) =
j, c (j)
0 , c(j) 1
). , π(j) In particular, it holds that
V (j) (( pk 0 , pk 1 , c (j)
0 , c(j) 1 , crs(j−1) , . . . , crs (0)) , π (j) , crs (j)) = 1 .
Now, the fact that with a non-negligible probability S 2 fails with Ext (j) immediately translates to a
malicious prover that contradicts the knowledge extraction property of the argument system Π (j) .
We now prove that for every i ∈ {1, . . . , 6} the distributions D i and D i+1 are computationally
indistinguishable.
Lemma 4.3. The distributions D 1 and D 2 are computationally indistinguishable.
Proof. Whenever A 2 outputs an invalid ciphertext, or outputs a valid ciphertext and S 2 generates
a certification chain, the distributions D 1 and D 2 are identical. Indeed, in such a case the perfect
decryption property guarantees that Dec ′ (
sk c
(i) ) = f ( m (0)) . Therefore, D 1 and D 2 differ only
when when A 2 outputs a valid ciphertext but S 2 fails to generate a certification chain. Lemma 4.2
guarantees that this event occurs with only a negligible probability.
Lemma 4.4. The distributions D 2 and D 3 are computationally indistinguishable.
Proof. This follows from the zero-knowledge property of Π (0) . Specifically, any efficient algorithm
that distinguishes between D 2 and D 3 can be used (together with S) in a straightforward manner
to contradict the zero-knowledge property of Π (0) .
Lemma 4.5. The distributions D 3 and D 4 are computationally indistinguishable.
17
3. Targeted Malleability