DataTerminology.comNEW
A practical public-key encryption scheme with provable security against adaptive chosen-ciphertext attacks under standard assumptions.
DESCRIPTION
The Cramer–Shoup cryptosystem strengthens ElGamal-like designs to achieve IND-CCA2 security without random oracles. It uses two generators and additional hashing and verification components to thwart ciphertext malleability and decryption oracle attacks. Its security proof relies on standard hardness assumptions in discrete-log-based groups. Cramer–Shoup influenced modern KEM-DEM constructions and provides a template for CCA-secure encryption in practice. Although less common than RSA-OAEP in deployed systems, it remains a landmark scheme in provable security.
ALTERNATIVE DEFINITIONS
Wikipedia
In cryptography, the Cramer–Shoup cryptosystem is a public key encryption scheme secure against adaptive chosen-ciphertext attack under standard assumptions.
Emphasizes CCA2 security under standard assumptions.
Springer
We propose a practical public-key encryption scheme that is provably secure against adaptive chosen ciphertext attack under standard assumptions.
Original paper’s abstract highlights practicality and CCA2 security.
RELATED TERMS
Asymmetric Encryption Chosen-Ciphertext Security Key Encapsulation Mechanism Hash Proof System Discrete Logarithm Problem KEM-DEM TLS Hybrid Encryption Ciphertext Integrity
COMPETING TERMS
Elgamal RSA-OAEP
KNOWLEDGE AREAS
Data Security Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Software Developer
EXTERNAL SOURCES
- Wikipedia - Cramer–Shoup cryptosystem
- Springer - Original Cramer–Shoup paper (CRYPTO’98)
- Handbook of Applied Cryptography - Background on DL-based encryption
TOP QUESTIONS
What makes Cramer–Shoup different from Elgamal?
Cramer–Shoup includes additional components to ensure ciphertext integrity and provides provable IND-CCA2 security without random oracles.
Category: Example
Is Cramer–Shoup used in mainstream protocols?
It influenced practice but is less commonly standardized than RSA-OAEP; many systems use KEM-DEM with authenticated encryption.
Category: Opinion
What assumptions underlie Cramer–Shoup security?
Hardness of discrete logarithms and related group assumptions underpin its security proof.
Category: Requirements
What are common mistakes when implementing Cramer–Shoup?
Incorrect parameter generation, skipping hash checks, or failing group element validation undermines CCA security.
Category: Mistakes
How does Cramer–Shoup relate to KEM-DEM?
It motivates CCA-secure designs; KEM-DEM composes key encapsulation with authenticated encryption to achieve similar guarantees.
Category: Example
What is the biggest benefit of Cramer–Shoup?
Strong, provable protection against chosen-ciphertext attacks in a practical scheme.
Category: Relevancy
What curve or group should be used with Cramer–Shoup?
Use well-vetted discrete-log groups or elliptic curves with secure parameters and constant-time implementations.
Category: Management
How does Cramer–Shoup compare to RSA-OAEP?
Both aim for CCA security; RSA-OAEP is often more widely deployed, while Cramer–Shoup provides strong proofs in DL groups.
Category: Alternatives
Where to learn Cramer–Shoup details?
Read the original CRYPTO’98 paper and textbook chapters covering CCA-secure public-key encryption.
Category: Requirements