I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertexts of some arbitrary chosen plaintexts. Unfortunately, I haven't found a good definition of OW-CCA, but I assume it has something to do with an Oracle and Chosen Ciphertexts. So, in my understanding, OW-CCA is defined as the inability of an attacker to find out the key by choosing an arbitrary number of ciphertexts and letting the Oracle decrypt these.

In IND-CPA, the attacker has the ability to encrypt chosen plaintexts, which basically anyone can do. In OW-CCA, the attacker can reverse the ciphertexts to plaintexts and is dependent on the oracle

Since the attacker has less power in IND-CPA the security goal is more easily achieved, which makes the attacker model weaker.

Is that correct?


1 Answer 1


It is not difficult to build examples to show that the two notions are incomparable, in the sense that there exist schemes that are IND-CPA but not OW-CCA, and there exist schemes that are OW-CCA and not IND-CPA.

For example, take any public-key IND-CPA scheme, and modify it so that ${\sf Enc}_{pk}(sk) = pk$, implying that ${\sf Dec}_{sk}(pk)=sk$. I argue that this scheme is still IND-CPA, since it only reveals $sk$ in the case that a decryption query of $pk$ can be issued. Since there is no decryption oracle, this is safe. However, this is clearly not OW-CCA for any definition, since given a CCA oracle, it is possible to obtain the private key $sk$.

Next, take any OW-CCA scheme with deterministic encryption. (For my answer to be complete, I need to argue that such a scheme exists, but I'll leave that to you.) It is clear that this scheme is not IND-CPA since if you encrypt the same message twice, you get the same ciphertext.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.