I'm a student studying cybersecurity for the first time, and the part where our textbook explains using CCA attacks for RSAs seemed really unclear for me, so I am here seeking for clarification.
Our textbook quotes
if the attacker receives encrypted message c = m^e (mod n), they can multiply by the encryption of a random number r^e (mod n) and ask the decryption oracle to decrypt r^e*c, which gives them back rm. Finally, they can multiply by r^(−1) (mod n) to recover m.
I understand everything except the ask the decryption oracle to decrypt r^e*c part - I learned that RSA decryption keys are kept private, then how would the attacker be able to use the decryption oracle?
More generally, I think my misunderstanding stems from my lack of knowledge regarding Kerckhoffs's principle. We never had a clear lecture on this, and my understanding is that, basically, we assume the attacker has the knowledge of everything about the system minus the keys themselves. Does this imply the attacker also has knowledge of the decryption oracle? Then how would this make any sense, since the attacker can simply decrypt any ciphertext they find..?
I would more than appreciate if someone with more expertise be able to sort some of the details out here.