1
$\begingroup$

I've seen it mentioned multiple times, but have not seen a formal proof of how security of an encryption scheme against a non adaptive chosen-ciphertext attacker (under non-malleability or ciphertext indistinguishability) implies security against an adaptive chosen-plaintext attacker.

Does IND-CCA1 imply IND-CPA (and NM-CCA1 imply NM-CPA)?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ The usual argument is that it's "obvious" as the attacker is given strictly more possibilities in the CCA1 scenario as opposed to the CPA one. $\endgroup$
    – SEJPM
    May 14, 2017 at 22:26

1 Answer 1

Reset to default
1
$\begingroup$

Simply consider the two games and a reduction between them. From the contapositive you need to show that every attacker against CPA yields a CCA1 one. Now, from every CPA adversary you can always construct an adversary that breaks CCA1 but simply makes/requires no decryption query (clearly the same holds for CCA2).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.