# Encrypting decryption key

What's that property called when a scheme is secure even if you encrypt the decryption key? Some schemes have problems when your plaintext is the decryption key (or just the key if symmetric).

• Its called circular security. Dec 23, 2014 at 9:42

To see why consider, for example, the usual definition of semantic security for a public-key encryption scheme $\Pi = (Gen, Enc, Dec)$: We say that $\Pi$ is semantically secure if all adversaries $A$ has at most negligible advantage (in security parameter $\lambda$) in the following security game:
1. We sample $(pk, sk) \leftarrow Gen(1^\lambda)$, and send $pk$ to $A$ (here $pk$ is the public key and $sk$ the secret decryption key).
2. $A$ outputs messages $m_0$ and $m_1$.
3. We sample $b \leftarrow \{0,1\}$ (a random bit), and send $c \leftarrow Enc(pk,m_b)$ to $A$.
4. $A$ outputs a bit $b'$ and wins if $b = b'$.
The problem here is that this only talks about security for some messages $m_0$ and $m_1$ that $A$ can pick. However, since $A$ does not know $sk$ there is negligible probability that she will pick $sk$ as a message (in fact if $A$ could pick $sk$ with non negligible probability the scheme would not be secure!). So using this definition we cannot say much about the circular security of the scheme.