Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC)

where I should focus on Theorem 3.2, which is the following implication:
INT-CTXT $\wedge$ IND-CPA $\rightarrow$ IND-CCA

Accordingly, I am trying to verify that the antecedent of the implication holds when using a pseudorandom function as a block cipher. I am currently stuck with the part whether the property of IND-CPA security holds. If I understood it correctly, the IND-CPA security depends on the mode of operation in which the pseudorandom function is used. In our lecture it was mentioned that an encryption scheme using a pseudorandom function as block cipher is indeed CPA-secure if the CTR mode (with a randomly chosen initial ctr) or the CBC mode is used. However, as far as I know it does not hold for other modes.

Therefore, I would like to know which mode of operation is used by IPsec and whether my approach makes sense.

• Did you mean pseudo-random-permutation? Jan 6, 2016 at 15:25
• No, the block cipher should really be a pseudorandom function, not a pseudo-random-permutation. Jan 6, 2016 at 15:31
• But why are you mentioning CBC mode then, which is not compatible with PRFs? The proper model for a block cipher is a (strong) PRP. Since PRPs can approximate PRFs up to the birthday bound we can use PRPs even in PRF assuming modes like CTR. Jan 6, 2016 at 15:35
• In the lecture we were told that if we have a PRF and the message length is fixed, then the CBC-mode with a random IV for each message is IND-CPA secure. That is why I mentioned the CBC mode and thought that it was compatible with PRFs. Further, in the exercise it is explicitely stated that the block cipher has to be a PRF. Therefore, I have to prove it for a PRF and not a PRP. Jan 6, 2016 at 15:54