Let $F : \{0,1\}^n \times \{0,1\}^n \rightarrow \{0,1\}^n $ be a PRF. And let the encryption function be $Enc{_k}(m) = r\mathbin\| (F{_k}(m\bigoplus r)$ , r being a random value.

Im trying to proof that this scheme is not CCA-secure, however I'm already failing at finding a correct decryption. Since a PRF is not invertible, how is it possible to recover the $m$ from the ciphertext?

  • 2
    $\begingroup$ What you have there can in general not be decrypted. Where did you find this supposed scheme? Are you sure it's not supposed to be $(r,F_k(r) \oplus m)$? $\endgroup$ – Maeher Jul 11 '20 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.