![](https://csdnimg.cn/release/download_crawler_static/15684886/bg4.jpg)
384 B. Qin and S. Liu
hardness of subset membership problem requires that elements in V are indis-
tinguishable from those in C\V.
In our construction, the secret key is just sk from the HPS, and the HPS and
OT-LF are integrated into a ciphertext CT,
CT =(C, s, Ψ = Ext(K, s) ⊕ M, Π = LF
Fpk,t
(K),t
c
),
via K = HPS.Pub(pk,C,w)=HPS.Priv(sk, C) (it holds for all C ∈V).
The encapsulated key K functions in two ways. (1) It serves as an input,
together with a random string s,toextractorExt(K, s) to mask and hide the
plaintext M to deal with key leakage. (2) It serves as the input of LF
Fpk,t
(·)
to check the well-formedness of the ciphertext. Tag t =(t
a
,t
c
) is determined
by t
a
=(C, s, Ψ) and a random t
c
. LF
Fpk,t
(K) can also be considered as an
authentication code, which is used to authenticate the tag t =((C, s, Ψ),t
c
)
with the authentication key K.
In the security proof, some changes are made to the generation of the challenge
ciphertext CT
∗
=(C
∗
,s
∗
,Ψ
∗
,Π
∗
,t
∗
c
): C
∗
is sampled from C\V and the tag t
∗
is made lossy by computing a proper t
c
with trapdoor Ftd. A PPT adversary
cannot tell the changes due to the hardness of subset membership problem and
the indistinguishability of lossy tags and injective ones. Conditioned on CT
∗
,
the encapsulated key K
∗
= HPS.Priv(sk, C
∗
) still maintains a high min-entropy
since Π
∗
= LF
Fpk,t
∗
(K
∗
) works in lossy mode and only little information is
released. When a PPT adversary chooses an invalid ciphertext CT in the sense
that C ∈C\Vfor decryption query, the corresponding tag t is injective with
overwhelming probability. Then LF
Fpk,t
(·) is injective and Π preserves the high
min-entropy of K = HPS.Priv(sk, C). Hence invalid ciphertexts will be rejected
by the decryption oracle with overwhelming probability. On the other hand,
the information of pk has already determined K = HPS.Priv(sk, C) for all C ∈
V. Thus the decryption oracle does not help the adversary to gain any more
information about K
∗
.ThenanextractorcanbeappliedtoK
∗
to totally mask
the information of challenge plaintext, and a large min-entropy of K
∗
conditioned
on pk and Π
∗
implies a high tolerance of key leakage.
Thanks to efficient constructions for HPS and OT-LF under the DDH and
DCR assumptions, the instantiations are practically efficient. More precisely,
|K|≈L/2, where L is the length of the secret key of HPS. Due to the lossiness
of the OT-LF and the property of the HPS, the min-entropy conditioned on the
public key and challenge ciphertext, approaches (1/2−o(1))L. Hence the leakage
rate approaches 1/2.
2 Preliminaries
Notation. Let [n]denotetheset{1,...,n}.Letκ ∈ N denote the security
parameter and 1
κ
denote the string of κ ones. If s is a string, then |s| denotes its
length, while if S is a set then |S| denotes its size and s ← S denotes the operation
of picking an element s uniformly at random from S.Wedenotey ← A(x)the