# Definition of ciphertext security

If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts).

I do not understand why encryption system (E,D) where D(k,0)=0 is considered as ciphertext secure.

Imagine CPA security game where an attacker just submits two plaintexts, m0 = 0 and m1 = (any value != 0). In that case if poor challenger returns 0 then we are certain that we're in experiment 0 and win CPA game.

What I am missing here?

• Where do you get the idea from that such a scheme would be CCA secure? Feb 2 '15 at 8:39
• Such schemes can't provide plaintext integrity (and thus also can't provide ciphertext integrity), but that has very little to do with IND-CPA. $\;$
– user991
Feb 2 '15 at 8:40
• @Maeher, I added a screenshot. Feb 2 '15 at 8:49
• Where does it state in the screenshot that such a scheme is secure? Feb 2 '15 at 8:56
• @Maeher, it does not state here that D(k,0)=0 is considered as ciphertext secure. However it was stated in the problem set in crypto class. I gave apparently wrong answer, and as an explanation I got "Consider a chosen ciphertext secure encryption system (E,D) where D(k,0)=0." Feb 2 '15 at 9:01

## 1 Answer

The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general.

To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme. We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows: $$\mathsf{E'}(k,m) = 1\Vert \mathsf{E}(k,m)$$ and $$\mathsf{D'}(k,b\Vert c) = \left\{\begin{array}{ll} 0& \text{if } b = 0\\ \mathsf{D}(k,c)& \text{if } b = 1\end{array}\right.$$

It is trivial to show via reduction that $(\mathsf{E'},\mathsf{D'})$ inherits the CCA security from $(\mathsf{E},\mathsf{D})$, but still it has the property that $\mathsf{D'}(k,0)=0$.

As you can see, your attack does not work, because $0$ is never encrypted to $0$ by the challenger.

• ... and D'(k,empty_string)=0. $\;$
– user991
Feb 2 '15 at 10:38