I want to construct a CPA-secure schemes using two given schemes $\prod_1$ and $\prod_2$ if only one of them is CPA secure.

Taking suggestions from this answer, I am able construct a scheme as follows.

Given a message $m$, Generate a random string $r$, of same lenght as $m$.

Compute $r_2 = r \oplus m$

Encrypt $r$ using $\prod_1$ to get $c_1$ and $r_2$ using $\prod_2$ to get $c_2$.

Send both $c1$ and $c2$

The scheme must be CPA secure because both of the ciphertexts need to be decrypted to get back the message.

However, I am not able to prove that the resultant scheme is CPA secure other than intuition.

How do I prove it rigorously?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.