I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\}^∗\to \{0,1\}^∗$

How can I build a new cipher out of $(Enc,Dec)$ with the keys $(k_1,k_2)$ which would be CCA-secure under partial key exposure i.e. the adversary knows only one of the key?

I was thinking of implementing a cipher $(Enc', Dec')$ such that $Enc'(P) = Enc_{k_2}(Dec_{k_1}(Enc_{k_2}(M)))$ and $Dec'(C) = Dec_{k_2}(Enc_{k_1}(Dec_{k_2}(M)))$ but then realized this scheme isn't secure CCA secure if the key k2 is known. I also read the paper On the Security of Multiple Encryption or CCA-security+CCA-security=CCA-security? but wasn't too successful in understanding all the concepts listed in the paper. Any hints or idea on this will be extremely helpful. Thanks!



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.