# Can we achieve IND-CCA without a MAC?

In modern cryptography, IND-CPA is the lowest security we want. We want at least IND-CCAx security from encryption mode. Their relation can be found in

All classical block cipher modes of operations (CTR,CBC,OFB,CFB,PCBC), as stated confidentiality only modes of operations in Wikipedia can achieve at most Ind-CPA.

It is easy to go beyond IND-CPA security with a secure MAC like HMAC, KMAC, etc., or even on can achieve Authentication Encryption mode where the provided security is more than Ind-CCAx.

Are there ways to achieve Ind-CCA without a MAC?

• Could you consider this rather a canonical question? Oct 27, 2022 at 6:27
• If including a constant "check" value (such as that being done with NIST-SP-800-38F key-wrapping mode) is what @poncho mean with "CCA without MAC", then that's pretty boring. Oct 27, 2022 at 11:36
• I'm expecting more than though... Oct 27, 2022 at 11:59

If you have a strong pseudorandom permutation $$F$$ with inputs/outputs of length $$n + \lambda$$ -- so either very short messages or a rather wide-block PRP -- then you can get a CCA-secure encryption scheme for $$n$$-bit messages:
$$\begin{array}{l} \underline{\textsf{Enc}(k,m):} \\ \quad r \gets \{0,1\}^\lambda \\ \quad c := F(k, m \| r) \\ \quad \mbox{return } c \end{array}$$
(decrypt by doing $$F^{-1}$$ and throwing away the last $$\lambda$$ bits.)
• In addition, if you change it to $c := F(k, m||r||0^k)$ (and have the receiver check that the last $k$ bits are all zero after decryption, and fail if not), you also get integrity guarantees, again, without a MAC... Oct 27, 2022 at 19:33