@techreport{oai:ipsj.ixsq.nii.ac.jp:00062517,
 author = {Peng, Yang and Rui, Zhang and Kanta, Matsuura and Hideki, Imai and Peng, Yang and Rui, Zhang and Kanta, Matsuura and Hideki, Imai},
 issue = {42},
 month = {Jun},
 note = {The concept of stateful encryption was introduced to reduce computation cost of conventional public key encryption schemes. Bellare et al. proposed one stateful encryption scheme in random oracle model which can save one exponentiation from two, and another scheme in the standard model which can save one exponentiation from three. To remove the gap assumption in Bellare's random oracle scheme, Yang et al. showed a trade-off between assumption and computation. Above, all the schemes were built in the same manner: using an IND-CCA secure symmetric key encryption to achieve data privacy, and the symmetric key being provided by a key encapsulation. This means the provable security of all above schemes depends on the security of both symmetric key encryption and key encapsulation. In this paper, we first formalize the key encapsulation part, i.e., we propose a new primitive named stateful key encapsulation mechanism. Then, we show how to achieve stateful encryption by composing our primitive and symmetric encryption in a generic way., The concept of stateful encryption was introduced to reduce computation cost of conventional public key encryption schemes. Bellare et al. proposed one stateful encryption scheme in random oracle model which can save one exponentiation from two, and another scheme in the standard model which can save one exponentiation from three. To remove the gap assumption in Bellare's random oracle scheme, Yang et al. showed a trade-off between assumption and computation. Above, all the schemes were built in the same manner: using an IND-CCA secure symmetric key encryption to achieve data privacy, and the symmetric key being provided by a key encapsulation. This means the provable security of all above schemes depends on the security of both symmetric key encryption and key encapsulation. In this paper, we first formalize the key encapsulation part, i.e., we propose a new primitive named stateful key encapsulation mechanism. Then, we show how to achieve stateful encryption by composing our primitive and symmetric encryption in a generic way.},
 title = {Stateful Key Encapsulation Mechanism},
 year = {2009}
}