Due to a comment stating "... QR-PKE is secure (CPA)..." I've been thinking of how to prove that it's not CCA secure, and would like to understand whether my proof is correct.
Here's the QR-PKE scheme:
$KeyGen(1^n)$ produces:
$sk = (p,q)$ - two large n-bit primes
$pk = (n, x)$ where $N=pq$ and $x$ is a random $QNR \in_R \mathbb{Z}^*_N$.
$Enc_{pk}(b) = x^br^2 \mod N$ , where $r \in_R \mathbb{Z}^*_N$ (random)
$Dec_{sk}(c)=0$ iff $c$ is a $QR$
I thought of the following interaction in the CCA security game (key points) - the adversary sends the two challenge options: $0,1$. The challenger chooses one of them, $b$, and sends its encryption, $c$. The adversary randomly chooses $r \in \mathbb{Z}^*_N$ and asks to decrypt $c x^0r^2$. If the response is $1$ he knows that the second option (i.e. $1$) was chosen, otherwise $0$ was chosen, and responds accordingly. The correctness follows from the fact that the group product of two encryptions is the encryption of the XOR, in this scheme.
Have I got it right?