# CCA security problem

Let $$(\mathsf{Gen}, E, D)$$ be a CCA-secure public key encryption system with a message space $$\{0,1\}^{128}$$. Is the following derived cipher $$(\mathsf{Gen}, E', D')$$ also CCA-secure? Justify your answer.

$$\begin{array}{l} E’(\operatorname{pk}, m)&=&E(\operatorname{pk}, m + 1^{128})&\text{and}\\ D’(\operatorname{sk}, c)&=&D(\operatorname{sk}, c) + 1^{128} \end{array}$$

I've come across this exercise and the answer was apparently yes, it is CCA-secure, although I don't understand why, Can't the active adversary clearly see the part of the encrypted message $$1^{128}$$ during decryption $$D’(\operatorname{sk}, c)=D(\operatorname{sk}, c) \oplus1^{128}$$ and therefore be able to exploit this vulnerability to manipulate the ciphertext and observe the effects on the decrypted message? For example send $$m_0=m+1^{128}+1^{128}$$ since he also has CPA security power? I'd appreciate help.

• I'd bet a cup of coffee that it should be $m \oplus 1^{128}$. I.e. the operation is bitwise exclusive or, not concatenation as you seem to think. Dec 18, 2023 at 16:36
• I guess I missed that Dec 18, 2023 at 16:39
• I second that the question's $+$ most certainly is bitwise exclusive-OR, often noted $\oplus$ (though the $+$ notation makes perfect sense too in a context where it's clear that arguments are bitstrings), rather than concatenation, typically noted $\mathbin\Vert$. Suggestion: first understand why the derived cipher is sound (that is, always decipher correctly) assuming the original is, and what property of $\oplus$ is used. That property is not possessed by $\mathbin\Vert$, ordinary addition, or addition modulo $2^{128}$, regardless of endianness and other conventions.
– fgrieu
Dec 18, 2023 at 17:12

To do the actual proof, we can set a CCA game with two adversaries. Adversary A = (A1, A2) is the CCA adversary attacking PE = (Gen, E, D) and adversary B = (B1, B2) is the CCA adversary attacking PE' = (Gen, E', D') as defined above. Essentially, we want to prove that PE being CCA-secure implies PE' being CCA-secure. To help illustrate the game, here's the following sketch: