I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\Pi_0$ and $\Pi_1$. As IND-CCA security implies IND-CPA security, so $\Pi$ is IND-CPA secure. Is $\Pi$ is IND-CCA secure? How to prove or disprove it?

  • $\begingroup$ How are $\Pi_0$ and $\Pi_1$ combined? ​ ​ $\endgroup$
    – user991
    Jul 27, 2016 at 9:09
  • $\begingroup$ function composition $\endgroup$ Jul 27, 2016 at 9:19
  • $\begingroup$ In which order are they composed and which one is CCA? $\endgroup$
    – Maeher
    Jul 27, 2016 at 10:37
  • $\begingroup$ @Maeher this reads like a homework (to me at least) and the twist probably is that you don't know which one has which property and should prove that the resulting scheme is (not) IND-CCA security (depending on the order?). $\endgroup$
    – SEJPM
    Jul 27, 2016 at 10:58

1 Answer 1


You should really specify how are they combined. If it is just composition, you should analyze the cases $S_1=\Pi_0\circ \Pi_1$ $S_2=\Pi_1\circ \Pi_0$, $S_3=\Pi_0\circ \Pi_0$ and $S_4=\Pi_1\circ \Pi_1$, where $\Pi_0$ is CCA and $\Pi_1$ is CPA. If you manage to prove a security type all four cases, you may establish rules for a general composition. However, you may also consider the meet in the middle case when composing if that is your definition of IND-CCA.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.