is not secure. Instead, we prove that security is satis ed when the encryption scheme is INDCCA secure and it also follows that the protocol becomes Forward private.

eorem .

If the encryption scheme of Figure . is IND-CPA secure then the scheme is correct and NarrowForward private. Furthermore, if the cryptosystem is IND-CCA secure, then the scheme is secure and Forward private.

We divide our proof in four parts. In the rst part, we show that the scheme is correct and secure for the reader. We then demonstrate that it is secure for the tags. Finally, we prove that it is Narrow-Forward private. We conclude that it is Forward private using Lemma . .

. . Correctness and Security for the Reader

Correctness is trivially induced by the correctness of the public-key encryption. Regarding security for the reader, it follows from eorem . based on IND-CCA security.

. . Security for the Tags

We let the security experiment played by a xed A that has her environment simulated by B. e later has access to a decryption oracle that it uses to simulate the queries that require the secret key, namely S R (c; ) and R ( ). For that, it just queries the decryption oracle with c, gets a bit-string that it matches against ID KID a and returns the last bits of the recovered plaintext in case of success. Otherwise, it returns a random bit-string. e

same procedure is used to decide on the success of a protocol session.

Again, we let Si be the event that the adversary wins the security experiment in Game i.

Game . Let S0 be the event that the adversary wins the security experiment. Note that the adversary does not issue a S R (c; ) on the target session that induces a matching conversation. ( is is the unique value that makes the tag accept and the adversary win so getting it from S R results in a matching conversation.)

Game . We make a change in Game and de ne Game as being the same except that all queriesS ( ; ) neverproducean a thatwassentbeforetotheS T interface. In other words, we require that A never guesses a. As a is chosen uniformly, when A makes s calls to S T , the probability of this event happening is bounded by s2 so that

j Pr[S0] Pr[S1]j s2 :

Since s is polynomially bounded, this probability is negligible when 2 is negligible.

. - -

Game . We now modify the way B handles S R (c; ) queries in instances that have either no matching conversation but c was the output of a S T query or a matching conversation with an illegitimate tag. For those, B returns uniformly distributed b ’s.

Simulationisperfectasillegitimatetagsgetrejectedwithprobability1 ( edatabase does not contain their corresponding entry) and ciphertexts that embed a reader challenge di erent from the one of the instance provoke the failure of the comparison a er decryption. In other words,

Pr[S2] = Pr[S1]

Game . We further adapt B’s behavior regarding S R (c; ) queries for sessions thathavematchingconversationwithlegitimatetags. SinceB isalsohandling S - T queries, it knows the plaintext corresponding to the c sent in an instance with matching conversation. We thus modify B so that it keeps a table of pairs (a; b) for every ciphertext produced for a legitimate tag. is way, B does not need to access its decryption oracle for c’s that were produced by legitimate tags in matching sessions. Clearly, we have that

Pr[S3] = Pr[S2]

Game . We now alter the S T (a; vtag) interface so that instead of computing the encryption of ID KID a b, it encrypts a random R of the same length. (Recall that no such output is sent by B to the decryption oracle.)

We now construct a hybrid argument to show that j Pr[S4] Pr[S3]j is negligible. We construct the hybrids as follow: B(i) is an algorithm simulating A for which the i rst S T (ai; vtag) queries are treated by picking a random bi and encrypting ID KID ai bi. e rest of the queries are processed by encrypting random strings. We let C denote an adversary playing the IND-CCA game, simulating B2(i)/B2(i + 1), that submits ID KID ai bi (as in B2(i + 1)) and R (as in B2(i)) to the IND-CCA challenger who randomly chooses one of the messages and returns its encryption. C then continues B2(i)/B2(i + 1)’s execution and returns its

.

. - -