Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
... in terms of existence of schemes or particular schemes? $\;$ – Ricky Demer Jul 12 '14 at 23:22
IND-CCA2 is equivalent to NM-CCA2. – Henrick Hellström Jul 13 '14 at 0:18
@RickyDemer, please answer it for any mode. – abdolahS Jul 13 '14 at 0:34
CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.) – K.G. Jul 14 '14 at 16:56
@K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify. – Henrick Hellström Jul 14 '14 at 22:05

No. RSA-OAEP is indistinguishable under adaptive chosen cipher text attacks (and even non malleable under adaptive chosen cipher text attacks), but it is not an instance of authenticated encryption. - The sender who encrypts the message might even be anonymous to the recipient who decrypts the message.

More generally, in a successful Chosen Cipher text Attack the adversary gets the honest decryptor to accept a forged cipher text, decrypt it, and accept the resulting plain text. It is not primarily a key recovery attack (although in some cases it might be extended into one). In fact, you can't turn a CCA against a secure block cipher in any standard mode, into a key recovery attack. You can however alter the decrypted plain text by altering the cipher text, unless the scheme is NM-CCA2. Often this is enough - most attacks against SSL/TLS don't actually recover any secret key, but only gets the recipient to accept plain text as authentic even though it is not.

In the case of asymmetric encryption, this gets more complicated. Plain unpadded RSA is not secure against CCA (which at the same time makes it possible to use it for homomorphic encryption). RSA-OAEP is secure against CCA, meaning you can't take a RSA-OAEP cipher text encrypted by someone else, alter it (in any other way than by replacing it with another message RSA-OAEP encrypted with the same public key), and get the owner of the private key to decrypt it.

share|improve this answer

No, CCA does not imply authenticated encryption. CCA tries to recover the secret using chosen ciphertexts. A well designed block cipher should in itself already process the property that the key cannot be retrieved. If used with a properly implemented block mode of operation, this property should hold.

Using authenticated encryption a CCA attack should not be possible, as no plaintext should be returned to the attacker if the authentication fails.

share|improve this answer
I'm assuming a block cipher here. – Maarten Bodewes Jul 13 '14 at 2:35
Downvoter, please add a comment to downvotes or improve the answer instead. – Maarten Bodewes Jul 16 '14 at 15:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.