Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is some random string of same length as m. The goal of the adversary is now to guess which one the challenger sends back. However, the adversary already has the pk, so why can't he himself not just encrypt his message and check if it fits with the one he got back?

share|improve this question
Because encryption is not deterministic. – fkraiem 16 hours ago
Thank you! That was really simple, it just didn't occur to me. – Cathrine 16 hours ago
Somebody can perhaps write a more detailed answer, my time is lacking right now... – fkraiem 16 hours ago

1 Answer 1

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

share|improve this answer
Just to recall what CCA requires. The OP should already have this question when looking at CPA... – DrLecter 15 hours ago
Ok, I guess it might be useful to actually state that CCA requires/implies CPA security too, but this is of course entirely correct either way. – otus 15 hours ago

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.