CCA-2 key recovery attack to an homomorphic scheme?

Question

It is known that homomorphic encryption schemes are not secure against CCA attacks. This is because in the security game, the attacker may use homomorphic evaluation to cheat in the the challenges and ask for a decryption of a (homomorphically equivalent of the) challenge itself.

However, I found a key-recovery attack. The attacker adaptively asks for decryption of ciphertexts, and at the end she knows the secret key.

Is this of some actual value? Or, just because the scheme is known to be CCA insecure, the hypothesis of an attacker asking for decryptions is no longer valid?

Or else, maybe I am not aware of generic key-recovery attacks using CCA semantic security attacks? If this is the case, please point out a reference.

Answer 1

An interesting approach would be to determine if your CCA attack can be done in the first or in the second phase of the game. That is, before or after the challenge ciphertext is generated. This corresponds to a CCA1 or CCA2 attack, respectively.

CCA2 as usually understood cannot be attained by HE schemes, but CCA1 can. Therefore, your attack may be trivial if it is actually a CCA2 attack, or not if it is a CCA1 attack. Anyway, in the end, it all depends on the claimed security notion of the HE scheme. If they never said it is CCA1/2, then there may be little value to your attack...It's like finding a CPA attack on textbook RSA or a CCA2 attack on textbook ElGamal.