- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
No. RSA-OAEP is indistinguishable under adaptive chosen cipher text attacks (and even non malleable under adaptive chosen cipher text attacks), but it is not an instance of authenticated encryption. - The sender who encrypts the message might even be anonymous to the recipient who decrypts the message.
More generally, in a successful Chosen Cipher text Attack the adversary gets the honest decryptor to accept a forged cipher text, decrypt it, and accept the resulting plain text. It is not primarily a key recovery attack (although in some cases it might be extended into one). In fact, you can't turn a CCA against a secure block cipher in any standard mode, into a key recovery attack. You can however alter the decrypted plain text by altering the cipher text, unless the scheme is NM-CCA2. Often this is enough - most attacks against SSL/TLS don't actually recover any secret key, but only gets the recipient to accept plain text as authentic even though it is not.
In the case of asymmetric encryption, this gets more complicated. Plain unpadded RSA is not secure against CCA (which at the same time makes it possible to use it for homomorphic encryption). RSA-OAEP is secure against CCA, meaning you can't take a RSA-OAEP cipher text encrypted by someone else, alter it (in any other way than by replacing it with another message RSA-OAEP encrypted with the same public key), and get the owner of the private key to decrypt it.
No, CCA does not imply authenticated encryption. CCA tries to recover the secret using chosen ciphertexts. A well designed block cipher should in itself already process the property that the key cannot be retrieved. If used with a properly implemented block mode of operation, this property should hold.
Using authenticated encryption a CCA attack should not be possible, as no plaintext should be returned to the attacker if the authentication fails.