Which attacker model is weaker? IND-CPA or OW-CCA?

Question

I know that IND-CPA is a security goal, which is defined as the inability of an attacker to distinguish two ciphertext of some arbitrary chosen plaintexts. Unfortunately i havent found a good definition of OW-CCA, but i assume it has something to do with an Oracle and Chosen Ciphertexts. So in my understanding OW-CCA is defined as the inability of an attacker to find out the key by chosing an arbitrary number of Ciphertexts and letting the Oracle decrypt these.

In IND-CPA the Attacker has the ability encrypt chosen plaintexts, which basically anyone can do. In OW-CCA, the Attacker can reverse the ciphertexts to plaintexts and is dependant on the oracle

Since the attacker has less power in IND-CPA the security goal is more easily achieved, which makes the attacker model weaker.

Is that correct?

Answer 1

It is not difficult to build examples to show that the two notions are incomparable, in the sense that there exist schemes that are IND-CPA but not OW-CCA, and there exist schemes that are OW-CCA and not IND-CPA.

For example, take any public-key IND-CPA scheme, and modify it so that ${\sf Enc}_{pk}(sk) = pk$, implying that ${\sf Dec}_{sk}(pk)=sk$. I argue that this scheme is still IND-CPA, since it only reveals $sk$ in the case that a decryption query of $pk$ can be issued. Since there is no decryption oracle, this is safe. However, this is clearly not OW-CCA for any definition, since given a CCA oracle, it is possible to obtain the private key $sk$.

Next, take any OW-CCA scheme with deterministic encryption. (For my answer to be complete, I need to argue that such a scheme exists, but I'll leave that to you.) It is clear that this scheme is not IND-CPA since if you encrypt the same message twice, you get the same ciphertext.