A Universally Composable Secure Channel Based on the KEM-DEM Framework

Waka NAGAO; Yoshifumi MANABE; Tatsuaki OKAMOTO

doi:10.1093/ietfec/e89-a.1.28

A Universally Composable Secure Channel Based on the KEM-DEM Framework

Waka NAGAO, Yoshifumi MANABE, Tatsuaki OKAMOTO

Full Text Views

0

Share
Cite this

Summary :

As part of ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, which DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, that uses KEM and DEM, while KEM supports distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM, which is semantically secure against adaptively chosen ciphertext attacks (IND-CCA2), and DEM, which is semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2), along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (non-malleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E89-A No.1 pp.28-38

Publication Date: 2006/01/01

Publicized

Online ISSN: 1745-1337

DOI: 10.1093/ietfec/e89-a.1.28

Type of Manuscript: Special Section PAPER (Special Section on Cryptography and Information Security)

Category: Public Key Cryptography

Cite this

Copy

Waka NAGAO, Yoshifumi MANABE, Tatsuaki OKAMOTO, "A Universally Composable Secure Channel Based on the KEM-DEM Framework" in IEICE TRANSACTIONS on Fundamentals, vol. E89-A, no. 1, pp. 28-38, January 2006, doi: 10.1093/ietfec/e89-a.1.28.
Abstract: As part of ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, which DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, that uses KEM and DEM, while KEM supports distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM, which is semantically secure against adaptively chosen ciphertext attacks (IND-CCA2), and DEM, which is semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2), along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (non-malleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent.
URL: https://globals.ieice.org/en_transactions/fundamentals/10.1093/ietfec/e89-a.1.28/_p

Copy

@ARTICLE{e89-a_1_28,
author={Waka NAGAO, Yoshifumi MANABE, Tatsuaki OKAMOTO, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={A Universally Composable Secure Channel Based on the KEM-DEM Framework},
year={2006},
volume={E89-A},
number={1},
pages={28-38},
abstract={As part of ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, which DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, that uses KEM and DEM, while KEM supports distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM, which is semantically secure against adaptively chosen ciphertext attacks (IND-CCA2), and DEM, which is semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2), along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (non-malleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent.},
keywords={},
doi={10.1093/ietfec/e89-a.1.28},
ISSN={1745-1337},
month={January},}

Copy

TY - JOUR
TI - A Universally Composable Secure Channel Based on the KEM-DEM Framework
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 28
EP - 38
AU - Waka NAGAO
AU - Yoshifumi MANABE
AU - Tatsuaki OKAMOTO
PY - 2006
DO - 10.1093/ietfec/e89-a.1.28
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E89-A
IS - 1
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - January 2006
AB - As part of ISO standards on public-key encryption, Shoup introduced the framework of KEM (Key Encapsulation Mechanism), and DEM (Data Encapsulation Mechanism), for formalizing and realizing one-directional hybrid encryption; KEM is a formalization of asymmetric encryption specified for key distribution, which DEM is a formalization of symmetric encryption. This paper investigates a more general hybrid protocol, secure channel, that uses KEM and DEM, while KEM supports distribution of a session key and DEM, along with the session key, is used for multiple bi-directional encrypted transactions in a session. This paper shows that KEM, which is semantically secure against adaptively chosen ciphertext attacks (IND-CCA2), and DEM, which is semantically secure against adaptively chosen plaintext/ciphertext attacks (IND-P2-C2), along with secure signatures and ideal certification authority are sufficient to realize a universally composable (UC) secure channel. To obtain the main result, this paper also shows several equivalence results: UC KEM, IND-CCA2 KEM and NM-CCA2 (non-malleable against CCA2) KEM are equivalent, and UC DEM, IND-P2-C2 DEM and NM-P2-C2 DEM are equivalent.
ER -