I have two public key encryption scheme $\Pi_0$ and $\Pi_1$ and one of them is IND-CCA secure, another one is IND-CPA secure. Let $\Pi$ be a public key encryption scheme, which is a combination of $\Pi_0$ and $\Pi_1$. As IND-CCA security implies IND-CPA security, so $\Pi$ is IND-CPA secure. Is $\Pi$ is IND-CCA secure? How to prove or disprove it?

  • $\begingroup$ How are $\Pi_0$ and $\Pi_1$ combined? ​ ​ $\endgroup$ – user991 Jul 27 '16 at 9:09
  • $\begingroup$ function composition $\endgroup$ – Pinkimani Goswami Jul 27 '16 at 9:19
  • $\begingroup$ In which order are they composed and which one is CCA? $\endgroup$ – Maeher Jul 27 '16 at 10:37
  • $\begingroup$ @Maeher this reads like a homework (to me at least) and the twist probably is that you don't know which one has which property and should prove that the resulting scheme is (not) IND-CCA security (depending on the order?). $\endgroup$ – SEJPM Jul 27 '16 at 10:58

You should really specify how are they combined. If it is just composition, you should analyze the cases $S_1=\Pi_0\circ \Pi_1$ $S_2=\Pi_1\circ \Pi_0$, $S_3=\Pi_0\circ \Pi_0$ and $S_4=\Pi_1\circ \Pi_1$, where $\Pi_0$ is CCA and $\Pi_1$ is CPA. If you manage to prove a security type all four cases, you may establish rules for a general composition. However, you may also consider the meet in the middle case when composing if that is your definition of IND-CCA.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.