I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure.

Taking suggestions from this answer, I am able construct a scheme as follows.

Given a message $m$, Generate a random string $r$, of same lenght as $m$.

Compute $r_2 = r \oplus m$

Encrypt $r$ using $\prod_1$ to get $c_1$ and $r_2$ using $\prod_2$ to get $c_2$.

Send both $c1$ and $c2$

The scheme must be CPA secure because both of the ciphertexts need to be decrypted to get back the message.

However, I am not able to prove that the resultant scheme is CPA secure other than intuition.

How do I prove it rigorously?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.