org.cryptimeleon.craco.kem.asym.elgamal

Class ElgamalKEM

java.lang.Object

org.cryptimeleon.craco.kem.asym.elgamal.ElgamalKEM

All Implemented Interfaces:

AsymmetricKEM<SymmetricKey>, KeyEncapsulationMechanism<SymmetricKey>, org.cryptimeleon.math.serialization.annotations.RepresentationRestorer, org.cryptimeleon.math.serialization.Representable, org.cryptimeleon.math.serialization.StandaloneRepresentable

public class ElgamalKEM
extends java.lang.Object
implements AsymmetricKEM<SymmetricKey>

This class implements the Fujisaki Okamoto transformation (FOT) of an ElGamal KEM.

The FOT is a transformation to transform a CPA secure public key encryption scheme into a CCA secure encryption scheme in the RO model.

The main idea of FOT is to replace the randomness of ElGamal encryption with a commitment on a random Message. Then, after decaps/decrypt we can check the commitment by re-encrypt the decrypted message with the same commitment as randomness.

ElGamal:

Group \(\mathbb{G}\) of size \(q\), generator \(g\), public key \(h=g^a\), secret key \(a\)

Encrypt message \(R\):

1. Select \(s\) uniformly at random from \(\mathbb{Z}_q\)
2. Output ciphertext \(C=(R g^{as},g^s)\)

Decrypt \(C\):

1. Parse C as \(C=(C_1,C_2)\)
2. Compute \(C_1 \cdot C_2^(-a)\)

FOT Elgamal with KEM and \(H_1 : \mathbb{G} \times \{0,1\}^n \rightarrow \mathbb{Z}_q, H_2 : \mathbb{G} \rightarrow \{0,1\}^n\),

Encaps \(k\):

1. Select \(R\) uniformly at random from \(\mathbb{G}\) and \(k\) uniformly at random in \(\{0,1\}^n\), and compute \(s=H(R,k)\) (commitment on \(R,k\))
2. Elgamal encrypt \(R\) with random tape \(s\) to obtain \((C_1,C_2)\)
3. One-time-pad encrypt \(k\) with \(r=H_2(R)\): \(C_3= r \oplus k\)
4. Output \(C = (C_1, C_2, C_3)\)

Decaps \(k\):

1. Parse \(C=(C_1,C_2,C_3)\)
2. Elgamal decrypt \((C_1,C_2)\) to obtain message \(R'\)
3. One-time-pad decrypt \(C_3\) with \(H_2(R)\) to obtain \(k'\)
4. Recover commitment \(s'=H_1(R',k')\)
5. Check commitment by ElGamal encrypting \(R'\) with \(s'\) and comparing it with \(C_1 \cdot a\). If ok, return \(k' \cdot b\). Otherwise return fail

See Also:

ElgamalEncryption

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	ElgamalKEM.KeyAndCiphertextAndNonce

Nested classes/interfaces inherited from interface org.cryptimeleon.craco.kem.KeyEncapsulationMechanism

KeyEncapsulationMechanism.KeyAndCiphertext<T>

Constructor Summary

Constructors

Constructor and Description
ElgamalKEM(org.cryptimeleon.math.structures.groups.Group group, org.cryptimeleon.math.hash.HashFunction md) Setup Elgamal KEM for given group and message digest.
ElgamalKEM(org.cryptimeleon.math.serialization.Representation repr)

Method Summary

Modifier and Type	Method and Description
ByteArrayImplementation	decaps(CipherText encapsulatedKey, DecryptionKey sk) Takes an encapsulated key that was created by encaps() and decrypts it with sk.
ElgamalKEM.KeyAndCiphertextAndNonce	encaps_internal(EncryptionKey pk) Generates a random symmetric key, encapsulates it, and returns it together with the nonce used and ciphertext.
KeyEncapsulationMechanism.KeyAndCiphertext<SymmetricKey>	encaps(EncryptionKey pk) Randomly chooses a key k and encrypts it using the given pk.
boolean	equals(java.lang.Object obj)
EncryptionKeyPair	generateKeyPair()
ElgamalEncryption	getEncryptionScheme()
org.cryptimeleon.math.hash.HashFunction	getHashFunction()
ByteArrayImplementation	getKey(org.cryptimeleon.math.serialization.Representation repr)
org.cryptimeleon.math.serialization.Representation	getRepresentation()
int	hashCode()
ElgamalPrivateKey	restoreDecapsulationKey(org.cryptimeleon.math.serialization.Representation repr)
ElgamalKEMCiphertext	restoreEncapsulatedKey(org.cryptimeleon.math.serialization.Representation repr)
EncryptionKey	restoreEncapsulationKey(org.cryptimeleon.math.serialization.Representation repr)
void	setEncryptionScheme(ElgamalEncryption encryptionScheme)
void	setHashFunction(org.cryptimeleon.math.hash.HashFunction messageDigest)

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.cryptimeleon.craco.kem.KeyEncapsulationMechanism

restoreFromRepresentation

Constructor Detail

ElgamalKEM

public ElgamalKEM(org.cryptimeleon.math.structures.groups.Group group,
                  org.cryptimeleon.math.hash.HashFunction md)

Setup Elgamal KEM for given group and message digest.

Here, md is used to construct hash functions H1 and H2.

Parameters:

group - - group where scheme is defined

md - - message digest to construct hash functions

ElgamalKEM

public ElgamalKEM(org.cryptimeleon.math.serialization.Representation repr)

Method Detail

hashCode

public int hashCode()

Overrides:

hashCode in class java.lang.Object

equals

public boolean equals(java.lang.Object obj)

Overrides:

equals in class java.lang.Object

getRepresentation

public org.cryptimeleon.math.serialization.Representation getRepresentation()

Specified by:

getRepresentation in interface org.cryptimeleon.math.serialization.Representable

encaps

public KeyEncapsulationMechanism.KeyAndCiphertext<SymmetricKey> encaps(EncryptionKey pk)

Description copied from interface: KeyEncapsulationMechanism

Randomly chooses a key k and encrypts it using the given pk. The result is (key, encapsulatedKey).

Specified by:

encaps in interface KeyEncapsulationMechanism<SymmetricKey>

Parameters:

pk - public key used for encrypting k

encaps_internal

public ElgamalKEM.KeyAndCiphertextAndNonce encaps_internal(EncryptionKey pk)

Generates a random symmetric key, encapsulates it, and returns it together with the nonce used and ciphertext.

Parameters:

pk - the public key to use for encapsulation

Returns:

the resulting key, ciphertext, and nonce

decaps

public ByteArrayImplementation decaps(CipherText encapsulatedKey,
                                      DecryptionKey sk)

Description copied from interface: KeyEncapsulationMechanism

Takes an encapsulated key that was created by encaps() and decrypts it with sk. That is, if (key, encapsulatedKey) = encaps(pk), then decrypt(encapsulatedKey, sk) == key.

Specified by:

decaps in interface KeyEncapsulationMechanism<SymmetricKey>

generateKeyPair

public EncryptionKeyPair generateKeyPair()

Specified by:

generateKeyPair in interface AsymmetricKEM<SymmetricKey>

getKey

public ByteArrayImplementation getKey(org.cryptimeleon.math.serialization.Representation repr)

restoreEncapsulatedKey

public ElgamalKEMCiphertext restoreEncapsulatedKey(org.cryptimeleon.math.serialization.Representation repr)

Specified by:

restoreEncapsulatedKey in interface KeyEncapsulationMechanism<SymmetricKey>

restoreEncapsulationKey

public EncryptionKey restoreEncapsulationKey(org.cryptimeleon.math.serialization.Representation repr)

Specified by:

restoreEncapsulationKey in interface KeyEncapsulationMechanism<SymmetricKey>

restoreDecapsulationKey

public ElgamalPrivateKey restoreDecapsulationKey(org.cryptimeleon.math.serialization.Representation repr)

Specified by:

restoreDecapsulationKey in interface KeyEncapsulationMechanism<SymmetricKey>

getEncryptionScheme

public ElgamalEncryption getEncryptionScheme()

setEncryptionScheme

public void setEncryptionScheme(ElgamalEncryption encryptionScheme)

getHashFunction

public org.cryptimeleon.math.hash.HashFunction getHashFunction()

setHashFunction

public void setHashFunction(org.cryptimeleon.math.hash.HashFunction messageDigest)