# CCA security of this scheme

Let $$k$$ be uniformly sampled from $$\{0,1\}^\lambda$$, $$F$$ be a secure PRP with block length $$\lambda$$ and let $$Enc(k, m)$$ be such that it returns $$c = (F(k,r), r \oplus F(k,m))$$ with $$r$$ uniformly sampled from $$\{0,1\}^\lambda$$. How to prove that this scheme is not CCA secure? In particular, how can an attack be thought of?

• You mean scheme. – DannyNiu Aug 21 '19 at 8:50
• Thanks. I think that also for these reasons there is an 'edit' button clickable by everyone :) – Bruce Wayne Aug 21 '19 at 11:15

• Suppose we have a valid cipher text $$(A, B) = F(k, r), r \oplus F(k, m)$$. What happens if we modify the ciphertext to be $$(A, B \oplus C)$$ and get that decrypted?
• How can we use this? What can we do if we have two ciphertexts that encrypt the same message $$m$$?
• Thinking about the decryption algorithm, can be $F^{-1}(k, F^{-1}(k,A) \oplus B)$, but now I can't see which $C$ can be useful in this scenario. I'll think about it – Bruce Wayne Aug 20 '19 at 18:32