It is known that homomorphic encryption schemes are not secure against CCA attacks. This is because in the security game, the attacker may use homomorphic evaluation to cheat in the the challenges and ask for a decryption of a (homomorphically equivalent of the) challenge itself.

However, I found a key-recovery attack. The attacker adaptively asks for decryption of ciphertexts, and at the end she knows the secret key.

Is this of some actual value? Or, just because the scheme is known to be CCA insecure, the hypothesis of an attacker asking for decryptions is no longer valid?

Or else, maybe I am not aware of generic key-recovery attacks using CCA semantic security attacks? If this is the case, please point out a reference.


1 Answer 1


An interesting approach would be to determine if your CCA attack can be done in the first or in the second phase of the game. That is, before or after the challenge ciphertext is generated. This corresponds to a CCA1 or CCA2 attack, respectively.

CCA2 as usually understood cannot be attained by HE schemes, but CCA1 can. Therefore, your attack may be trivial if it is actually a CCA2 attack, or not if it is a CCA1 attack. Anyway, in the end, it all depends on the claimed security notion of the HE scheme. If they never said it is CCA1/2, then there may be little value to your attack...It's like finding a CPA attack on textbook RSA or a CCA2 attack on textbook ElGamal.

  • $\begingroup$ Well the attack works as a simple decryption oracle: The attacker keeps sending ciphertexts and the oracle sends the decryption. There is no challenge. $\endgroup$ Commented Oct 28, 2016 at 10:24
  • $\begingroup$ The sequence of ciphertexts is adaptative, depending on the last plaintext received. $\endgroup$ Commented Oct 28, 2016 at 10:25
  • $\begingroup$ I mean if the ciphertexts that the attacker sends to the oracle depend on the challenge ciphertext. This is often the case on CCA2 attacks, but not in CCA1 attacks. $\endgroup$
    – cygnusv
    Commented Oct 28, 2016 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.