Subtleties in the Definition of IND-CCA: When and How Should Challenge Decryption Be Disallowed? - Bellare, Mihir; Hofheinz, Dennis; Kiltz, Eike (J. Cryptol., 2015)