## 1 Introduction
### Concept of Corrected Proofs  
Our strategy to revise [PERSON] et al. 's proofs [12] is to change the security condition of the underlying KEM from OW to CPA while keeping their conversion method intact. In our corrected proofs, the underlying KEM must be CPA-secure in terms of indistinguishability, meaning (roughly) the following: given \((\mathsf{CT}^{*},K^{*})\) as a challenge, it is infeasible to determine whether the challenge key \(K^{*}\) was correct or false with respect to the challenge ciphertext \(\mathsf{CT}^{*}\). Now, the simulator attacking the CPA security of the underlying KEM is given \((\mathsf{CT}^{*},K^{*})\) and wants to determine whether \(K^{*}\) is correct or false using the adversary against CCA-security. Let us assume that the underlying KEM is still NIZK-compatible, as defined in [12]. Given \((\mathsf{CT}^{*},K^{*})\), the simulator proceeds as follows: it sets the pair as the NIZK statement, \(\mathsf{stmt}^{*}=(\mathsf{CT}^{*},K^{*})\), and generates a simulated proof \(\pi^{*}\) for \(\mathsf{stmt}^{*}\) using the zero-knowledge property. Then, it computes the challenge key \(\mathsf{key}^{*}=H_{2}(\mathsf{stmt}^{*},\mathsf{com}^{*},\pi^{*})\), where \(\mathsf{com}^{*}\) is the relevant commitment for \(\mathsf{stmt}^{*}\). Then, it gives the challenge ciphertext \((\mathsf{CT}^{*},\pi^{*})\) and the challenge key \(\mathsf{key}^{*}\) to the adversary. If \(K^{*}\) is the correct key corresponding to \(\mathsf{CT}^{*}\), then \(\pi^{*}\) is the NIZK proof for the correct statement \((\mathsf{CT}^{*},K^{*})\). Otherwise, \(\pi^{*}\) is the NIZK proof for the false statement \((\mathsf{CT}^{*},K^{*})\). Now that the simulator knows the candidate value \(K^{*}\) of the KEM key, it does distinguish whether \(K^{*}\) is correct or false by checking whether \((\mathsf{stmt}^{*},\mathsf{com}^{*},\pi^{*})\) is issued to \(H_{2}\) queries. Note that \(K^{*}\) is not given to the adversary. If \(K^{*}\) (including \(\mathsf{stmt}^{*}\)) appears in \(H_{2}\) queries, it is possible to ensure (with overwhelming probability) that \(K^{*}\) is the correct key corresponding to \(\mathsf{CT}^{*}\); otherwise, \(K^{*}\) is a false key. Furthermore, as long as the input \((\mathsf{stmt}^{*},\mathsf{com}^{*},\pi^{*})\) is not queried to \(H_{2}\) (modeled as a random oracle), the adversary obtains no information on the challenge key \(\mathsf{key}^{*}\). It follows that success in breaking the CCA-security of the transformed KEM straightforwardly leads to success in breaking the CPA security of the underlying KEM without causing security loss. When applying our proof strategy to the above variant of the ElGamal KEM, it can be proved to be tightly CCA-secure under the DDH assumption. In our corrected proofs, decapsulation queries are handled by the simulator in the same way as in [12]. However, the NIZK property required for answering decapsulation queries is (one-time) _simulation soundness_ (SS) rather than soundness. This is because \(\pi^{*}\) can be the _simulated_ proof for the correct or false statement \((\mathsf{CT}^{*},K^{*})\) (given to the simulator) depending on \(K^{*}\). Furthermore, once \((\mathsf{CT}^{*},\pi^{*})\) is given to the adversary as a challenge, it should be difficult for the adversary to generate a pair of a new _false_ statement and its relevant proof that are correctly verified. In particular, a new false statement includesany modification of \(\text{stmt}^{*}=(\mathsf{CT}^{*},K^{*})\). Unlike in [PERSON] et al. 's proofs [12], the simulator in ours knows all hash input values regarding \(\text{stmt}^{*}\) and \(\text{com}^{*}\) explicitly; thus, the security flaw mentioned above does not occur. Rather, making hash queries about \(\text{stmt}^{*}\) by the adversary could increase the probability that the simulator will succeed in breaking the CPA security of the given KEM. To show that the underlying NIZK proof system satisfies the simulation soundness property, we use the result of [PERSON] et al.