In reference to the LR-Oracle experiment in “Introduction to Modern Cryptography” (2nd edition) by Lindell & Katz, Definition 3.23 states a scheme $\pi = (Gen,Enc_K,Dec_K)$ is CPA secure for multiple encryptions if (to use the notation of Lindell and Katz)

$$\begin{equation} \textbf{Pr}[\textbf{PrivK}_{\mathcal{A},\pi}^{LR-cpa}(n) = 1] \leq 1/2 + \textbf{negl(n)}\end{equation}$$

Some questions:

  1. I'm assuming that this implies that for $\pi$ that satisfies the above, it's safe to provide oracle access to $Enc_{K}(\cdot)$ to a CPA adversary $\mathcal{A}$, and by implication its safe to expose a counter mode encryption oracle to a CPA adversary

  2. If not, what is the exact definition that tells me the conditions under which it's safe to expose an encryption oracle to a CPA adversary?

  3. Since CCA security requires non-malleability in the cipher, is it true to say that adding authentication to a CPA secure scheme in the manner of an AEAD scheme is the sole requirement to additionally provide non-malleability / security against a CCA adversary, thereby making it safe to additionally expose a decryption oracle to $\pi$ to the adversary?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.