What is a cryptosystem? (Cramer-Shoup)

Secret Key:

x, y; a, b; a’, b’

Public Key:

g1, g2; h, c, d

h = g_1^x g_2^y

c = g_1^a g_2^b

d = g_1^a’ g_2^b’

Let H be some collision resistant hash function.

E(m, r) = (g_1^r, g_2^r, h^r * m, (c * a^B)^r)

B = H(a)

Proof of CCA-2 Security

Generate g1 to g4.

A and B want to compute f(x, y), but they don’t want to divulge x or y.