# CCA security problem

Let $$(\mathsf{Gen}, E, D)$$ be a CCA-secure public key encryption system with a message space $$\{0,1\}^{128}$$. Is the following derived cipher $$(\mathsf{Gen}, E', D')$$ also CCA-secure? Justify your answer.

$$\begin{array}{l} E’(\operatorname{pk}, m)&=&E(\operatorname{pk}, m + 1^{128})&\text{and}\\ D’(\operatorname{sk}, c)&=&D(\operatorname{sk}, c) + 1^{128} \end{array}$$

I've come across this exercise and the answer was apparently yes, it is CCA-secure, although I don't understand why, Can't the active adversary clearly see the part of the encrypted message $$1^{128}$$ during decryption $$D’(\operatorname{sk}, c)=D(\operatorname{sk}, c) \oplus1^{128}$$ and therefore be able to exploit this vulnerability to manipulate the ciphertext and observe the effects on the decrypted message? For example send $$m_0=m+1^{128}+1^{128}$$ since he also has CPA security power? I'd appreciate help.

• I'd bet a cup of coffee that it should be $m \oplus 1^{128}$. I.e. the operation is bitwise exclusive or, not concatenation as you seem to think. Commented Dec 18, 2023 at 16:36
• I guess I missed that Commented Dec 18, 2023 at 16:39
• I second that the question's $+$ most certainly is bitwise exclusive-OR, often noted $\oplus$ (though the $+$ notation makes perfect sense too in a context where it's clear that arguments are bitstrings), rather than concatenation, typically noted $\mathbin\Vert$. Suggestion: first understand why the derived cipher is sound (that is, always decipher correctly) assuming the original is, and what property of $\oplus$ is used. That property is not possessed by $\mathbin\Vert$, ordinary addition, or addition modulo $2^{128}$, regardless of endianness and other conventions.
– fgrieu
Commented Dec 18, 2023 at 17:12