Editing Cramer–Shoup cryptosystem (section)

=== Decryption ===
To decrypt a ciphertext <math>(u_1, u_2, e, v)</math> with Alice's secret key <math>(x_1, x_2, y_1, y_2, z)</math>,

* Alice computes <math>\alpha = H(u_1, u_2, e) \,</math> and verifies that <math>{u}_{1}^{x_1} u_{2}^{x_2} ({u}_{1}^{y_1} u_{2}^{y_2})^{\alpha} = v \,</math>.  If this test fails, further decryption is aborted and the output is rejected.
* Otherwise, Alice computes the plaintext as <math>m = e / ({u}_{1}^{z}) \,</math>.

The decryption stage correctly decrypts any properly-formed ciphertext, since

: <math> {u}_{1}^{z} = {g}_{1}^{k z} = h^k \,</math>, and <math>m = e / h^k. \,</math>

If the space of possible messages is larger than the size of <math>G</math>, then Cramer–Shoup may be used in a [[hybrid cryptosystem]] to improve efficiency on long messages.