No fixed-construction reduction from HE to IND-CCA2 Security

Unconditional · against fixed-construction reductions · folklore

Statement

The identity map does not turn HE into IND-CCA2-secure PKE: no HE scheme whose function class $\mathcal{F}$ contains an $f$ that is neither constant nor the identity on $\mathcal{M}$ (after fixing any further arguments of $f$ by fresh encryptions) is IND-CCA2-secure, since $\mathsf{Eval}$ turns the challenge ciphertext into an admissible decryption query that reveals the challenge bit — folklore.

Sketch

Pick $m_0,m_1$ with $f(m_0)\ne m_0$ and $f(m_1)\ne f(m_0)$, and on challenge $c^{\ast }$ compute $c^{\prime }\leftarrow \mathsf{Eval}(\mathsf{pk},f,c^{\ast })$. If $c^{\prime }\ne c^{\ast }$, the Phase-2 query $\mathsf{Dec}(\mathsf{sk},c^{\prime })$ returns $f(m_b)$, which determines $b$; if $c^{\prime }=c^{\ast }$, correctness forces $f(m_b)=m_b$, so $b=1$.

Notes

• IND-CCA1-secure fully homomorphic encryption is constructed from multi-key identity-based FHE, from sub-exponentially secure iO, and from SNARKs — CRRV17.
• Targeted malleability confines a scheme’s malleability to a declared set of allowable functions, giving a non-malleability guarantee alongside homomorphic evaluation — BSW12.