# Is Hybrid Encryption CCA secure?

If Enc is a PKE(Public Key Encryption) with key generation algorithm KG and message space $$M = \{0, 1\}^n$$, and SE is a Symmetric Key Encryption(SKE) with key space $$\{0, 1\}^n$$ and message space $$M' = \{0, 1\}^*$$ then the hybrid encryption uses the same key generation KG, but its message space is $$M' = \{0, 1\}^*$$ and its encryption procedure $$Enc'(p_k, m)$$ picks a random symmetric key $$k \gets \{0, 1\}^n$$ and outputs ciphertext $$(c, c')$$ where $$c = Enc(p_k, k)$$ and $$c' = SE(k, m)$$. The decryption given $$(c, c')$$ decrypts $$k$$ from $$c$$ using the private key corresponding to pk and then decrypts $$m$$ from $$c'$$ using $$k$$.

If Enc is a CPA secure PKE on $$M = \{0, 1\}^n$$ and SE is IND secure SKE on$$M' = \{0, 1\}^*$$, is Enc' CPA secure PKE on $$M'$$?

If Enc is CPA secure PKE and SE is CCA secure SKE, is Enc' CCA secure?

• Not quite sure, but intuition tells me that Enc should be CCA secure (at least when considering active adversaries). – VincBreaker Jun 2 '19 at 12:49
• So "Introduction to Modern Cryptography" talks a bit about hybrid encryption and KEMs. It would appear that plain CPA-secure encryption doesn't yield a CCA-secure KEM (because eg ElGamal is CPA secure but you can win the KEM-CCA game using the homomorphism) and the book requires a CCA secure KEM for CCA secure hybrid encryption. – SEJPM Jun 4 '19 at 9:32