When performing a CCA, the adversary gets the public key. At some point, he will send a message m to the challenger, and the challenger will send back either $E_{pk}(m)$ or $E_{pk}(r)$, where r is some random string of same length as m. The goal of the adversary is now to guess which one the challenger sends back. However, the adversary already has the pk, so why can't he himself not just encrypt his message and check if it fits with the one he got back?

  • $\begingroup$ Because encryption is not deterministic. $\endgroup$ – fkraiem Nov 25 '15 at 11:20
  • $\begingroup$ Thank you! That was really simple, it just didn't occur to me. $\endgroup$ – MBrown Nov 25 '15 at 11:23
  • $\begingroup$ Somebody can perhaps write a more detailed answer, my time is lacking right now... $\endgroup$ – fkraiem Nov 25 '15 at 11:27

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

  • $\begingroup$ Just to recall what CCA requires. The OP should already have this question when looking at CPA... $\endgroup$ – DrLecter Nov 25 '15 at 11:49
  • $\begingroup$ Ok, I guess it might be useful to actually state that CCA requires/implies CPA security too, but this is of course entirely correct either way. $\endgroup$ – otus Nov 25 '15 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.