# RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will hopefully clear that up.

Consider the RSA-based encryption scheme in which a user encrypts a message $$m ∈ \{0,1\}^{l}$$ with respect to the public key $$(N, e)$$ by computing $$m':= H(m)\|m$$ and outputting the ciphertext $$c:=m'^{e} \mod N.$$ (Here,let $$H:=\{0,1\}^{l}→ \{0,1\}^{n}$$ and assume $$l+n<\|N\|$$, the bit-length of $$N$$). The receiver recovers m' in the usual way and verifies that it has the correct form before outputting the $$l$$ least-significant bits as $$m$$. Prove or disprove that this scheme is CCA-secure if H is modeled as a random oracle.

• Random oracle (RO) quite clear, right? Jan 16, 2019 at 22:08
• @kelalaka yes, as a concept on its own.. don't know how to use it practically in the example. Jan 16, 2019 at 22:17

Hint: $$H$$ is chosen at the beginning of the CPA-game.