# Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?

• ... in terms of existence of schemes or particular schemes? $\;$
– user991
Jul 12 '14 at 23:22
• IND-CCA2 is equivalent to NM-CCA2. Jul 13 '14 at 0:18
• @RickyDemer, please answer it for any mode. Jul 13 '14 at 0:34
• CCA is an attack model. AE is usually a security. So the two aren't immediately comparable. Probably, you should be asking if IND-CCA implies AE, which isn't the case. (Start with an IND-CCA scheme, make it malleable by returning pseudo-random decryptions for malformed ciphertexts, observe that the resulting scheme remains IND-CCA, but is not AE.)
– K.G.
Jul 14 '14 at 16:56
• @K.G. The usual definition of malleability is that there exists a known function for transforming cipher texts into something that decrypts to related plain texts. Modifying an AE-scheme to return psuedo random plain text instead of an error doesn't qualify. Jul 14 '14 at 22:05