Paper 2025/2004 Original: eprint.iacr.org/2025/2004 ↗
Re-randomization Attack on the Certificateless Encryption Scheme proposed by Guo et al.
Abstract
Guo, Li, and Qin proposed a lightweight certificateless encryption (CLE) scheme designed for IoT environments (\textit{Discover Computing}, 2025). This paper demonstrates that the proposed scheme does not achieve CCA security, contrary to the authors' claim. Specifically, we identify two critical points. First, since the ciphertext retains a multiplicative ElGamal structure, it can always be re-randomized using arbitrary randomness. Second, based on this property, an adversary can transform a challenge ciphertext into another valid ciphertext of the same plaintext, and then query the decryption oracle with the transformed ciphertext to recover the challenge plaintext. This attack exploits a definitional gap in the CCA game, where only direct decryption queries on the challenge ciphertext are prohibited. In this work, we formalize the attack procedure and verify its validity based on implementation.
Metadata
- Available format(s)
PDF- Category
- Public-key cryptography
- Publication info
- Preprint.
- History
- 2025-10-27: last updated
- 2025-10-27: published
- Short URL
- https://ia.cr/2025/2004
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2025/2004,
author = {Nobuyuki Sugio and Keita Emura and Toshihiro Ohigashi},
title = {Re-randomization Attack on the Certificateless Encryption Scheme proposed by Guo et al.},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/2004},
year = {2025},
url = {https://eprint.iacr.org/2025/2004}
}