Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the Dolev Yao model for interactive protocols, the cryptographic primitive (encryption, for example) is considered as a blackbox.

Does blackbox here mean that the primitive is to be considered CPA secure, or does it even require CCA security?

My guess is that CPA is sufficient (and it is the minimum requirement), since the adversary model is rather passive. But could someone confirm this?

share|improve this question

In Dolev-Yao and other formal models, the assumptions about adversary behavior are encoded via the grammar and entailment relation, and there's no mention of a specific computational definition of encryption security.

But your question is still meaningful, and can be interpreted as follows:

If my encryption scheme is CPA secure, and my protocol is secure in the sense of Dolev-Yao, then is my protocol necessarily computationally secure?

This question has been studied, starting in a very nice paper by Abadi and Rogaway. For your question, their answer is "No, but CPA is almost enough." Caveats in the security definition involve whether the adversary can detect if two ciphertexts were generated with the same key, or if you encrypt "key cycles", whether message length is leaked, etc. The linked paper resolves all of these details.

share|improve this answer

This question has been studied, starting in a very nice paper by Abadi and Rogaway. [...] The linked paper resolves all of these details.

Please be aware that the paper by Abadi and Rogaway cited by another answer here only considers the passive adversary case, i.e., an adversary that can only eavesdrop but not insert messages. The active adversary case is still subject of ongoing research, and the full requirements have not been made precise, and some primitives seem impossible to handle in this abstract way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.