1: \begin{definition}

2: \label{def:cinm}

3: A \SKQES\ $(\KeyGen, \Enc, \Dec)$ is \emph{$\eps$-ciphertext non-malleable ($\eps$-\CiNM)} if, for any attack $\Lambda_A^{\ch[CB]{C\hat{B}}}$, its effective map $\Tilde{\Lambda}_A^{\ch[MB]{M\hat{B}}}$ is such that

4: \[ \dn{\Tilde{\Lambda}_A - \left(\id^{\ch{M}} \otimes \Lambda_1^{\ch[B]{\hat{B}}} + \frac{1}{|C|^2 - 1}\left(|C|^2\lr{\Dec_K(\tau^{\ch{C}})} - \id\right)^{\ch{M}} \otimes \Lambda_2^{\ch[B]{\hat{B}}}\right)} \leq \eps,\]

5: where

6: \begin{align*}

7:     \Lambda_1 &= \E\limits_{k,r}\left[\Trr[CM']{\psi^{\ch{CM'}}_{k,r}\Lambda_A(\psi^{\ch{CM'}}_{k,r} \otimes (\cdot))}\right]&and\\

8:     \Lambda_2 &= \E\limits_{k,r}\left[\Trr[CM']{(\I^{\ch{CM'}} - \psi^{\ch{CM'}}_{k,r})\Lambda_A(\psi^{\ch{CM'}}_{k,r} \otimes (\cdot))}\right].

9: \end{align*}

10: Here $\Enc_{k;r}$ is as in Theorem \ref{thm:charac}, $\E_{k,r}$ is taken uniformly over $k$ and with $r$ sampled according to $p_k$ from Theorem \ref{thm:charac}, and $\psi^{\ch{CM'}}_{k,r} = \Enc_{k;r}(\phi^{+\ch{MM'}})$.

11: A \SKQES is \emph{ciphertext non-malleable (\CiNM)} if it is $\eps$-\CiNM for some $\eps \leq \negl(n)$.

12: \end{definition}

13: