2
$\begingroup$

IND-CCA is an abbreviation of "Indistinguishability under chosen ciphertext attack" and generally, an adversary carrying out the chosen ciphertext attack is given a decryption oracle only. However, in the IND-CCA game, the adversary is allowed to make both encryption and decryption queries in the pre-querying phase.

Why is the adversary in the IND-CCA game allowed to make encryption queries even though the attacker is not assumed to be able to make encryption queries in the chosen cipher attack?

$\endgroup$
10
  • $\begingroup$ Welcome to Cryptography. This is our canonical question about this topic. Easy explanation of "IND-" security notions?. Does this provide answer to your question? $\endgroup$
    – kelalaka
    Oct 21, 2023 at 10:54
  • 2
    $\begingroup$ Could you provide link to this; generally an adversary carrying out the chosen ciphertext attack is given a decryption oracle only. $\endgroup$
    – kelalaka
    Oct 21, 2023 at 10:56
  • 1
    $\begingroup$ I'm guessing the naming has confused you. IND-CCA also includes all the capabilities of IND-CPA, it might be better to call it Indistinguishability under Chosen Plaintext and Chosen Ciphertext Attack, or IND-CPCCA, but that isn't as pretty a format. $\endgroup$ Oct 21, 2023 at 15:29
  • $\begingroup$ I think that a well written answer would be nice even though the answer linked to by @kelalaka does contain the information to provide that answer. $\endgroup$
    – Maarten Bodewes
    Oct 22, 2023 at 2:47
  • 1
    $\begingroup$ We want Ind-CCA > Ind-CPA, so if the attacker's capabilities are decreased then we cannot make the order. Keep in mind that in public key cryptography, the encryption is free. $\endgroup$
    – kelalaka
    Oct 22, 2023 at 11:44

1 Answer 1

3
$\begingroup$
  • In the Ind-CPA security we give access to the adversary to the encryption oracle as a black box.

    Ind-CPA also includes the Known-Plaintext Attack, and KPA < IND-CPA

    There are historical examples of Ind-CPA attacks. Directly quoting one from Wikipedia

    In World War II US Navy cryptanalysts discovered that Japan was planning to attack a location referred to as "AF". They believed that "AF" might be Midway Island, because other locations in the Hawaiian Islands had codewords that began with "A". To prove their hypothesis that "AF" corresponded to "Midway Island" they asked the US forces at Midway to send a plaintext message about low supplies. The Japanese intercepted the message and immediately reported to their superiors that "AF" was low on water, confirming the Navy's hypothesis and allowing them to position their force to win the battle.

    This is a real example of how one can query an encryption oracle in real life. There are more examples on the Wikipedia.

    Ind-CPA adversaries are considered passive adversaries. One might argue that they are allowed to access the encryption oracle as a black box, but they are still in the setting of observing passively transmitted ciphertexts.

    From the passive attacker, we want to go further to the active attacker, in which the attacker can modify the ciphertexts, too ( modify and query to decryption oracle). The padding oracle attack is one of the examples, though the attacker cannot get the decryption, still, they can get information to decrypt the blocks one by one.

  • In the Ind-CCA security we give access to the adversary to the encryption and decryption oracle as a black box.

    If we don't allow the encryption oracle, then we did not further on the Ind-CPA security, instead, we would have created a branch on the definitions; There might be a hypothetical algorithm that Ind-CCA secure but not Ind-CPA secure. Well, consider the historical example, except for creating noise in the air, CCA attackers cannot work without the encryption oracle and we might say(!) that it was secure against the CCA attacker *.

    Now, in the current definitions we have Ind-CPA < Ind-CCA and this is a nice ordering. For example, we can simply say that without authentication you cannot achieve Ind-CCA. Like all classical block-cipher modes of operations CTR, CBC, CFB, and OFB. ( except ECB ) we can achieve Ind-CPA however none can achieve Ind-CCA without a MAC.

And keep in mind that, in public key cryptography, the encryption oracle is free. Therefore, not allowing is also complicates things here.

Why is the adversary in the IND-CCA game allowed to make encryption queries even though the attacker is not assumed to be able to make encryption queries in the chosen cipher attack?

If we can achieve Ind-CPA security then in the current setting the CCA attacker might find that the encryption oracle might not be useful at all. Consider the Ind-CPA secure CBC mode, the padding oracle attacker cannot achieve anything with the encryption oracle since CBC mode is Ind-CPA secure. On the other hand with the (partial) decryption oracle (padding incorrect), it can achieve success.

The above case must not limit the CCA attacker so that they must not use encryption oracle. They are given power over CPA attackers they are active and can access the encryption and decryption oracle. So, whenever they can gain an advantage they can use both.


*I know that atmospheric noise can change radio signals in the air, however, this is not my subject, so there might be an improvement that one can change bits in the air. Still, at that time, I considered that it was not possible.

$\endgroup$
1
  • 1
    $\begingroup$ Thank you. It helps a lot! $\endgroup$
    – MLER
    Oct 24, 2023 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.