On the Security of Keyed-Homomorphic PKE: Preventing Key Recovery Attacks and Ciphertext Validity Attacks

Theoretically, an adversary sends a homomorphically evaluated challenge ciphertext to the decryption oracle, and can immediately break the security. One may think that this is just a theoretical result and there is no practical impact. Even thoughBleichenbacher’sCCAattack [2] has beenwidely recognized, it is also widely recognized that a weaker security level is acceptable in return for obtaining a homomorphic property. However, several CCA attacks against concrete homomorphic encryption schemes have been also shown. We introduce key recovery attacks (KRA) as follows.