1

Is there a lattice based PKE which is IND-CCA1 secure? Actually I am only familiar with LWE and SIS. So I want to know that what the IND-CCA1-secure LWE based PKE scheme looks like?

Blanco
  • 1,632
  • 1
  • 11
  • 20

1 Answers1

2

Yes. You can see Micciancio's annotated bibliography for some relevant papers (including generic transformations from CPA security to CCA security in the random oracle model). If you want to see "actual" schemes which are CCA1 secure, Kyber is a CCA2-secure KEM with security based on a variant of LWE over "Module Lattices", which can be viewed as a slight generalization of R-LWE.

Mark Schultz-Wu
  • 15,089
  • 1
  • 22
  • 53