# CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book.

Consider the RSA-based encryption scheme in which a user encrypts a message $$m ∈$$ {$$0, 1$$}$$^l$$ with respect to the public key $$(N, e)$$ by computing $$m' := H(m)||m$$ and outputting the ciphertext $$c' := m'^e modN$$. $$(H :$$ {$$0, 1$$}$$^l →$${$$0, 1$$}$$^n$$ and assume $$l + n < ||N||$$, $$||N||$$ is the bit-length of N). The receiver recovers $$m'$$ in the usual way and verifies that it has the correct form before outputting the $$l$$ least-significant bits as $$m$$. Prove or disprove that this scheme is CCA-secure if $$H$$ is modeled as a random oracle.

I know that this scheme isn't CCA-secure because it's deterministic.

But I tried to transform the cyphertext without success, because if I modify the second part of $$m'$$ let's say computing $$m''$$, using another cyphertext and multiplying it to $$c'$$, then I need $$H(m'')$$ to compose a correct cyphertext but since I don't know $$m'$$ I'm not able to query $$H(m'')$$.

• An attack against CPA security is an attack against CCA security which just chooses not to take advantage of the decryption oracle. – Mikero Jan 16 at 4:32
• Thanks for the reply. But how could it be attacked with CPA attack? – Processss Jan 16 at 9:01
• You already observed that the scheme is deterministic. What does that tell you? – Maeher Jan 16 at 10:01
• So I can just ask for the encryption of the messages (m0,m1) in the CPA-security game? – Processss Jan 16 at 10:03
• There's no need to ask. You can just compute it yourself. – Maeher Jan 16 at 14:23