Does CCA security imply authenticated encryption?

  • $\begingroup$ ... in terms of existence of schemes or particular schemes? $\;$ $\endgroup$
    – user991
    Jul 12, 2014 at 23:22
  • $\begingroup$ IND-CCA2 is equivalent to NM-CCA2. $\endgroup$ Jul 13, 2014 at 0:18
  • $\begingroup$ @RickyDemer, please answer it for any mode. $\endgroup$
    – abdolahS
    Jul 13, 2014 at 0:34
  • $\begingroup$ CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.) $\endgroup$
    – K.G.
    Jul 14, 2014 at 16:56
  • $\begingroup$ @K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify. $\endgroup$ Jul 14, 2014 at 22:05

2 Answers 2


No. RSA-OAEP is indistinguishable under adaptive chosen cipher text attacks (and even non malleable under adaptive chosen cipher text attacks), but it is not an instance of authenticated encryption. - The sender who encrypts the message might even be anonymous to the recipient who decrypts the message.

More generally, in a successful Chosen Cipher text Attack the adversary gets the honest decryptor to accept a forged cipher text, decrypt it, and accept the resulting plain text. It is not primarily a key recovery attack (although in some cases it might be extended into one). In fact, you can't turn a CCA against a secure block cipher in any standard mode, into a key recovery attack. You can however alter the decrypted plain text by altering the cipher text, unless the scheme is NM-CCA2. Often this is enough - most attacks against SSL/TLS don't actually recover any secret key, but only gets the recipient to accept plain text as authentic even though it is not.

In the case of asymmetric encryption, this gets more complicated. Plain unpadded RSA is not secure against CCA (which at the same time makes it possible to use it for homomorphic encryption). RSA-OAEP is secure against CCA, meaning you can't take a RSA-OAEP cipher text encrypted by someone else, alter it (in any other way than by replacing it with another message RSA-OAEP encrypted with the same public key), and get the owner of the private key to decrypt it.


No, CCA does not imply authenticated encryption. CCA tries to recover the secret using chosen ciphertexts. A well designed block cipher should in itself already process the property that the key cannot be retrieved. If used with a properly implemented block mode of operation, this property should hold.

Using authenticated encryption a CCA attack should not be possible, as no plaintext should be returned to the attacker if the authentication fails.

  • 2
    $\begingroup$ I'm assuming a block cipher here. $\endgroup$
    – Maarten Bodewes
    Jul 13, 2014 at 2:35
  • $\begingroup$ Downvoter, please add a comment to downvotes or improve the answer instead. $\endgroup$
    – Maarten Bodewes
    Jul 16, 2014 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.