I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\Pi_0$ and $\Pi_1$. As IND-CCA security implies IND-CPA security, so $\Pi$ is IND-CPA secure. Is $\Pi$ is IND-CCA secure? How to prove or disprove it?

  • $\begingroup$ How are $\Pi_0$ and $\Pi_1$ combined? ​ ​ $\endgroup$
    – user991
    Jul 27, 2016 at 9:09
  • $\begingroup$ function composition $\endgroup$ Jul 27, 2016 at 9:19
  • $\begingroup$ In which order are they composed and which one is CCA? $\endgroup$
    – Maeher
    Jul 27, 2016 at 10:37
  • $\begingroup$ @Maeher this reads like a homework (to me at least) and the twist probably is that you don't know which one has which property and should prove that the resulting scheme is (not) IND-CCA security (depending on the order?). $\endgroup$
    – SEJPM
    Jul 27, 2016 at 10:58

1 Answer 1


You should really specify how they are combined. If it is just composition, you should analyze the cases $S_1=\Pi_0\circ \Pi_1$, $S_2=\Pi_1\circ \Pi_0$, $S_3=\Pi_0\circ \Pi_0$ and $S_4=\Pi_1\circ \Pi_1$, where $\Pi_0$ is CCA and $\Pi_1$ is CPA. If you manage to prove a security type in all four cases, you may establish rules for a general composition. However, you may also consider the meet in the middle case when composing if that is your definition of IND-CCA.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.