# Chosen Cipher Text Security for Double Encryption

If $$E_k$$ is a CCA secure encryption scheme then why is $$E′_{(k_1,k_2)}(M)=E_{k_2}(E_{k_1}(M))$$, $$D′_{(k_1,k_2)}(C)=D_{k_1}(D_{k_2}(C))$$ not CCA secure when $$k_2$$ is known. Is there a way I can make a new cipher with keys $$(k_1, k_2)$$ such that its CCA secure regardless of which key the adversary finds?

My confusion here is how can I use the fact that key $$k_2$$ is known to break CCA security and why would that matter, because don't we treat these schemes as black-box when performing attack? What if I had $$k_1$$ instead, would that make any difference? And I'm quite clueless about the second part about new cipher using $$k_1, k_2$$ and still a secure CCA. Any idea or hint would be greatly appreciated.

• It is related to the bounds. You need to show that the advantage of the adversary os mo longer negligible according to the double the key size. Commented Nov 13, 2020 at 11:41
• What is bounds?
– Alex
Commented Nov 13, 2020 at 20:01
• The negligibility. Commented Nov 13, 2020 at 20:01
• @kelalaka I do understand that advantage should be negligible for the cipher to be secure but how can I show that its not negligible is my question for the given cipher when $k_2$ is known? How to approach is what I'm looking for.
– Alex
Commented Nov 13, 2020 at 22:51
• @kelalaka I'm now able to understand why the mentioned encryption scheme is not CCA secure when the $k_2$ is given!
– Alex
Commented Nov 15, 2020 at 0:58

## 1 Answer

To understand the case of double encryption's CCA security, I read the paper Chosen-Ciphertext Security of Multiple Encryption by Yevgeniy Dodis and Jonathan Katz in 2005.

With the help of this paper, now I'm able to understand why for the mentioned encryption scheme it will be no longer CCA secure when the key $$k_2$$ is known! Do give it a read for those having issues understanding CCA multiple encryption schemes.

• You can provide a little summary of the paper for the community. Commented Nov 15, 2020 at 13:49