On the Security of Padding-Based Encryption Schemes --- or --- Why We Cannot Prove OAEP Secure in the Standard Model

摘要: We investigate the security of "padding-based" encryption schemes in standard model. This class contains all public-key where algorithm first applies some invertible public transformation to message (the "padding"), followed by a trapdoor permutation. In particular, this OAEP and its variants. Our main result is black-box impossibility showing that one cannot prove any such padding-based scheme chosen-ciphertext secure even assuming existence ideal permutations. The latter strong abstraction permutations which inherits properties uniform random