Recently Cash, Kiltz, and Shoup [20] showed a variant of the Cramer-Shoup (CS) public key encryption (PKE) scheme [21] whose chosen-ciphertext (CCA) security relies on the computa...
We show that in applications that use the Diffie-Hellman (DH) transform but take care of hashing the DH output (as required, for example, for secure DH-based encryption and key ex...