2
$\begingroup$

In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in

All classical block cipher modes of operations (CTR,CBC,OFB,CFB,PCBC), as stated confidentiality only modes of operations in Wikipedia can achieve at most Ind-CPA.

It is easy to go beyond IND-CPA security with a secure MAC like HMAC, KMAC, etc., or even on can achieve Authentication Encryption mode where the provided security is more than Ind-CCAx.

Are there ways to achieve Ind-CCA without a MAC?

Improve this question
$\endgroup$
3
  • $\begingroup$ Could you consider this rather a canonical question? $\endgroup$
    – kelalaka
    Oct 27, 2022 at 6:27
  • $\begingroup$ If including a constant "check" value (such as that being done with NIST-SP-800-38F key-wrapping mode) is what @poncho mean with "CCA without MAC", then that's pretty boring. $\endgroup$
    – DannyNiu
    Oct 27, 2022 at 11:36
  • $\begingroup$ I'm expecting more than though... $\endgroup$
    – kelalaka
    Oct 27, 2022 at 11:59

1 Answer 1

Reset to default
3
$\begingroup$

Here is an example of a CCA-secure scheme that has no obvious appearance of a MAC. It's not an example of a general-purpose compiler from CPA to CCA security.

If you have a strong pseudorandom permutation $F$ with inputs/outputs of length $n + \lambda$ -- so either very short messages or a rather wide-block PRP -- then you can get a CCA-secure encryption scheme for $n$-bit messages:

$$ \begin{array}{l} \underline{\textsf{Enc}(k,m):} \\ \quad r \gets \{0,1\}^\lambda \\ \quad c := F(k, m \| r) \\ \quad \mbox{return } c \end{array} $$

(decrypt by doing $F^{-1}$ and throwing away the last $\lambda$ bits.)

Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ In addition, if you change it to $c := F(k, m||r||0^k)$ (and have the receiver check that the last $k$ bits are all zero after decryption, and fail if not), you also get integrity guarantees, again, without a MAC... $\endgroup$
    – poncho
    Oct 27, 2022 at 19:33
  • 1
    $\begingroup$ Ok, I've to admit that I was expecting something more complex. $\endgroup$
    – kelalaka
    Oct 27, 2022 at 20:44
  • $\begingroup$ @kelalaka That's just key-wrapping with randomized padding (without check value if we exclude poncho's idea). $\endgroup$
    – DannyNiu
    Oct 28, 2022 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.