# How do you prove an encryption scheme is IND-CPA or IND-CCA?

I know for proving a scheme is not IND-CPA or not IND-CCA you can construct an Adversary which has an unfair advantage in an experiment/game, but how would you prove a scheme is IND-CPA or IND-CCA?

• usually? by constructing an algorithm that - given the ability to break IND-CCA / IND-CPA - can break the assumed hard problem in polynomial time which proofs there can be no such algorithm because the assumption is that the problem is hard. – SEJPM May 8 '16 at 13:25
• As @SEJPM said: one proceeds by contrapositive, one suppose that such adversary with unfair advantage exists and proves that that adversary can be used to break a well known assumption, e.g.: one Adversary breaking some scheme can be used to factorise a composite integer (as defined in RSA). As today, after a huge effort and time spent on the factorisation problem, we dont have any efficient algorithm to factorise, that proves that the adversary do no extist, so the scheme is IND-CPA or IND-CCA secure. – ddddavidee May 10 '16 at 8:34