Blackbox Construction of a More Than Non-Malleable CCA1 Encryption Scheme from Plaintext Awareness

We construct an NM−CCA1 encryption scheme from any CCA1 encryption scheme that is also plaintext aware and weakly simulatable. We believe this is the first construction of a NM−CCA1 scheme that follows strictly from encryption schemes with seemingly weaker or incomparable security definitions to NM−CCA1. Previously, the statistical PA1 notion of plaintext awareness was only known to imply CCA1. Our result is therefore novel because unlike the case of CPA and CCA2, it is unknown whether a CCA1 scheme can be transformed into an NM-CCA1 scheme. Additionally, we show both the Damgard Elgamal Scheme (DEG) [Dam91] and the Cramer-Shoup Lite Scheme (CS-Lite) [CS03] are weakly simulatable under the DDH assumption. Since both are known to be statistical PA1 under the Diffie-Hellman Knowledge (DHK) assumption, they instantiate our scheme securely. Next, in a partial response to a question posed by Matsuda and Matsuura [MM11], we define an extended version of the NM−CCA1, cNM−CCA1, in which the security definition is modified so that the adversary is permuted to ask a c≥1 number of parallel queries after receiving the challenge ciphertext. We extend our construction to yield a cNM−CCA1 scheme for any constant c. All of our constructions are black-box.