U. Glaeser

In the random oracle model, chosen ciphertext security can be achieved by combining a basic public
key encryption scheme such as RSA with a simple “prepackaging” transform. Such a transform uses
random padding and unkeyed cryptographic hash functions to scramble the message prior to encryption.
The prepackaging transform is invertible, so that the message can be unscrambled after the ciphertext is
decrypted.
The optimal asymmetric encryption padding (OAEP) transform takes an m-bit message M, a random
bit string R of length s, and outputs OAEP(M, R) = ((M || 0 s ) xor H(R)) || (R xor G((M || 0 s ) xor H(R))).
Here G and H are unkeyed cryptographic hash functions that are assumed to have no exploitable
weaknesses (random oracles). This can be viewed as a two-round Feistel structure (e.g., DES is a 16-round
round Feistel structure). Unpackaging the transform is straightforward. The OAEP transform is used
extensively in practice, and has been incorporated in several standards. OAEP combined with RSA yields
an encryption scheme that is secure against a chosen ciphertext attack [33,34].
Shoup [35] shows that OAEP+, a variation on OAEP, yields chosen ciphertext security when combined
with essentially any public key encryption scheme: OAEP + (M, R) = ((M || W(M, R)) xor H(R)) || (R xor
G(M || W(M, R)) xor H(R)), where G, H, and W are unkeyed cryptographic hash functions that behave
like random oracles. Boneh [36] shows that even simpler prepackaging transforms (essentially one-round
Feistel structure versions of OAEP and OAEP+) yield chosen ciphertext secure encryption schemes when
combined with RSA or Rabin public key encryption.
Without the random oracle model, chosen ciphertext security can be achieved using the elegant
Cramer–Shoup cryptosystem [37]. This is based on the hardness of the Decision Diffie–Hellman problem
(see subsection “New Hardness Assumptions for Asymmetric Key Cryptography”). Generally speaking,
constructions in the random oracle model are more efficient than those without it.
Threshold Public Key Cryptography
In a public key setting, the secret key (for decryption or signing) often needs to be protected from theft
for long periods of time against a concerted attack. Physical security is one option for guarding highly
sensitive keys, e.g., storing the key in a tamper-resistant device. Threshold public key cryptography is an
attractive alternative for safeguarding critical keys.
In a threshold public key cryptosystem, the secret key is never in one place. Instead, the secret key is
distributed across many locations. Each location has a different “share” of the key, and each share of the
key enables the computation of a “share” of the decryption or signature. Shares of a signature or decryption
can then be easily combined to arrive at the complete signature or decryption, assuming that a sufficient
number of shareholders contribute to the computation. This “sufficient number” is the threshold that is
built into the system as a design parameter. Note that threshold cryptography can be combined with physical
security, by having each shareholder use physical means to protect his individual share of the secret key.
Threshold cryptography was independently conceived by Desmedt [38], Boyd [39], and Croft and
Harris [40], building on the fundamental notion of secret sharing [41,42]. Satisfactory threshold schemes
have been developed for a number of public key encryption and digital signature schemes. These threshold
schemes can be designed so as to defeat an extremely strong attacker who is able to travel from shareholder
to shareholder, attempting to learn or corrupt all shares of the secret key (“proactive security”). Efficient
means are also available for generating shared keys from scratch by the shareholders themselves, so that
no trusted dealer is needed to initialize the threshold scheme [43,44]. Shoup [45] recently proposed an
especially simple and efficient scheme for threshold RSA.
New Hardness Assumptions for Asymmetric Key Cryptography
A trend has occurred in recent years toward the exploration of the cryptographic implications of new
hardness assumption. Classic assumption include the hardness of factoring a product of two large primes,
the hardness of extracting roots modulo a product of two large primes, and the hardness of computing
discrete logarithms modulo a large prime (i.e., solving g x = y mod p for x).
One classic assumption is the Diffie–Hellman assumption. Informally stated, this assumption is that
it is difficult to compute (g ab mod p) given ( g a mod p) and (g b mod p), where p is a large prime. This assumption
© 2002 by CRC Press LLC