Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2.
What is the difference?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ Relevant paper: eprint.iacr.org/2003/174.pdf $\endgroup$– Ilmari KaronenCommented Dec 17, 2015 at 18:51
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Informally, CCA2 does not permit any kind of modification of ciphertexts, while RCCA permits some alteration as long as it does not alter the original message. For example, think of a publicly randomizable encryption scheme, that is, a scheme that permits to alter the original randomness used during encryption. CCA2 would consider these ciphertexts as invalid, while RCCA would accept them.
In the indistinguishability game (IND), this difference is translated in the restrictions to the use of the decryption oracle in phase 2. In CCA-2, the adversary is not allowed to ask for the decryption of the challenge ciphertext $c^*$, while in RCCA, if the adversary asks for the decryption of any ciphertext that decrypts to the challenge messages $m_0$ and $m_1$, he will only receive a special symbol $\mathsf{test}$.
-
$\begingroup$ No; in RCCA you can "ask for the decryption of" "the challenge messages $m_{\hspace{.02 in}0}$ and $m_1$"; you'll just get a special response if you do. $\endgroup$– user991Commented Dec 17, 2015 at 21:18
-
$\begingroup$ @RickyDemer You are right, although it is not that simple. Even the formalization of this very same issue in IND-CCA has some important subtleties. The choice made in original formulation of RCCA (i.e., returning a special symbol) is just another way to do it. $\endgroup$– cygnusvCommented Dec 18, 2015 at 11:07