Chosen-ciphertext security from subset sum