Authenticated Hybrid Encryption for Multiple Recipients

Authenticated encryption schemes used in order to send one message to one recipient have received considerable attention in the last years. We investigate the case of schemes, we call authenticated 1→n schemes, that allow one to encrypt efficiently in a public-key setting a message for several, say n, recipients in an authenticated manner. We propose formal security definitions for such schemes that work also for n = 1 and which are stronger and/or more general than those currently proposed. We then present a flexible mode of operation that transforms any 1→1 authenticated encryption scheme working on small messages into a 1→n authenticated encryption scheme working on longer messages. We show that it allows the construction of efficient 1→n schemes that are proved secure for the strongest security notion.