# Why is this scheme not IND-CCA2 secure

I know that many lattice cryptosystems cannot be made $\text{IND-CCA2}$ or even $\text{IND-CCA}$ secure without substantial overhead.

However, it seems that (when used as a KEM) that any $\text{IND-CPA}$ secure scheme can be converted to a secure-in-practice scheme by hashing the exchanged key before using it. The hash function seems to ensure that no information is leaked. By using an AEAD for the encrypted data, and including the KEM ciphertext in the AAD, it seems that the scheme becomes $\text{IND-CCA2}$.

What is the flaw in this scheme?

• This leaves open the possibility of generating a different ciphertext that encrypts to the same key. Maybe your proposal can achieve a weaker notion like RCCA security. – Mikero Jun 15 '17 at 1:45
• If you have a secure KEM, you can "trivially" construct an IND-CCA2 secure scheme. Now the trick is to create secure KEM and the way it's "usually" (ie with DHIES, ECIES and RSA-KEM) is to take your hard problem, create an instance of it that satisfies the precise hardness assumption and then hash (using the Random-Oracle model) the part of it that was hard to recover. – SEJPM Jun 15 '17 at 13:00