Let $k$ be uniformly sampled from $\{0,1\}^\lambda$, $F$ be a secure PRP with block length $\lambda$ and let $Enc(k, m)$ be such that it returns $c = (F(k,r), r \oplus F(k,m))$ with $r$ uniformly sampled from $\{0,1\}^\lambda$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?

  • $\begingroup$ You mean scheme. $\endgroup$
    – DannyNiu
    Aug 21, 2019 at 8:50
  • $\begingroup$ Thanks. I think that also for these reasons there is an 'edit' button clickable by everyone :) $\endgroup$ Aug 21, 2019 at 11:15

1 Answer 1


I won't give the answer; here are some hints:

  • Suppose we have a valid cipher text $(A, B) = F(k, r), r \oplus F(k, m)$. What happens if we modify the ciphertext to be $(A, B \oplus C)$ and get that decrypted?

  • How can we use this? What can we do if we have two ciphertexts that encrypt the same message $m$?

  • $\begingroup$ Thinking about the decryption algorithm, can be $F^{-1}(k, F^{-1}(k,A) \oplus B)$, but now I can't see which $C$ can be useful in this scenario. I'll think about it $\endgroup$ Aug 20, 2019 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.