Definition 3. An MKEM is a public-key primitive with two algorithms MKEM = (kgc, decaps) that have the following syntax: – kgc. Take an (implicit) security parameter and a public key pk0 and ▇▇▇▇▇▇ (▇▇▇, ▇▇▇, ▇▇▇, ▇▇▇). Here, (sk1, pk1) is a newly generated key pair. If pk0 =⊥ then ct1 = ss1 =⊥ (i. e., ▇▇▇▇▇▇ (▇▇▇, ▇▇▇, ⊥, ⊥) ← kgc(⊥)). Otherwise, use pk0 to generate a ciphertext ct1, in a way that pk1 and a shared secret ss1 can be retrieved from ct1 by invoking decaps. – decaps: receive a secret key sk0 and a ciphertext ct1 and retrieve the shared secret ss1 and pk1, i. e., (ss1, pk1) = decaps(sk0, ct1).
Appears in 2 contracts