1
$\begingroup$

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext indistinguishability) implies security against an adaptive chosen-plaintext attacker.

Does IND-CCA1 imply IND-CPA (and NM-CCA1 imply NM-CPA)?

$\endgroup$
  • 2
    $\begingroup$ The usual argument is that it's "obvious" as the attacker is given strictly more possibilities in the CCA1 scenario as opposed to the CPA one. $\endgroup$ – SEJPM May 14 '17 at 22:26
1
$\begingroup$

Simply consider the two games and a reduction between them. From the contapositive you need to show that every attacker against CPA yields a CCA1 one. Now, from every CPA adversary you can always construct an adversary that breaks CCA1 but simply makes/requires no decryption query (clearly the same holds for CCA2).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.