# How do I prove that a bit by bit PKE scheme (that is IND-CPA secure) for an n-bit message is not IND-CCA-2 secure?

$$Gen$$ generates $$pk$$ and $$sk$$ ($$\ell$$ bits each), $$\text{Enc}$$ encrypts $$m$$ of length $$\ell$$ bit by bit using each bit of $$pk$$ respectively, $$\text{Dec}$$ decrypts ciphertext bit by bit using each bit of $$sk$$ respectively.

How do I prove this scheme is not IND-CCA-2 secure?

• ... You find a CCA attack against the scheme, and show that the attack works. ​ ​
– user991
Commented Dec 6, 2015 at 8:30

An encryption scheme is said to be malleable if it is possible to change a valid ciphertext $$c$$ (i.e., a ciphertext generated by the encryption algorithm) to another valid ciphertext $$c' \neq c$$ (without utilizing the secret key) such that the underlying messages are related. Bit-by-bit encryption systems are malleable. This is because any valid ciphertext $$c = (c_1, c_2, \dots, c_n)$$ that is obtained by encrypting some $$n$$-bit message can be permuted to generate another valid ciphertext and the underlying messages are related by the same permutation.
Any malleable encryption is not CCA-2 secure because after receiving the challenger ciphertext $$c^*$$ from the challenger, the adversary can use this to construct another valid ciphertext $$c'$$ and query the decryption oracle to decrypt it. This will reveal information related to the message encrypted in $$c^*$$, helping the adversary to win the game.