Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is some random string of same length as m. The goal of the adversary is now to guess which one the challenger sends back. However, the adversary already has the pk, so why can't he himself not just encrypt his message and check if it fits with the one he got back?

share|improve this question
Because encryption is not deterministic. – fkraiem Nov 25 '15 at 11:20
Thank you! That was really simple, it just didn't occur to me. – Mai Nov 25 '15 at 11:23
Somebody can perhaps write a more detailed answer, my time is lacking right now... – fkraiem Nov 25 '15 at 11:27

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

share|improve this answer
Just to recall what CCA requires. The OP should already have this question when looking at CPA... – DrLecter Nov 25 '15 at 11:49
Ok, I guess it might be useful to actually state that CCA requires/implies CPA security too, but this is of course entirely correct either way. – otus Nov 25 '15 at 11:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.