# CCA Security/Decryption of PRF scheme

Let $$F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n$$ be a PRF. And let the encryption function be $$Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$$ , r being a random value.

Im trying to proof that this scheme is not CCA-secure, however I'm already failing at finding a correct decryption. Since a PRF is not invertible, how is it possible to recover the $$m$$ from the ciphertext?

• What you have there can in general not be decrypted. Where did you find this supposed scheme? Are you sure it's not supposed to be $(r,F_k(r) \oplus m)$? – Maeher Jul 11 at 20:24