I'm currently learning about chosen ciphertext attack and stumbled across a problem on CCA security. If I have an encryption scheme $(Gen,Enc,Dec)$, which is CCA-secure with $Enc:\{0,1\}^n\times \{0,1\}^∗\to \{0,1\}^∗$
How can I build a new cipher out of $(Enc,Dec)$ with the keys $(k_1,k_2)$ which would be CCA-secure under partial key exposure i.e. the adversary knows only one of the key?
I was thinking of implementing a cipher $(Enc', Dec')$ such that $Enc'(P) = Enc_{k_2}(Dec_{k_1}(Enc_{k_2}(M)))$ and $Dec'(C) = Dec_{k_2}(Enc_{k_1}(Dec_{k_2}(M)))$ but then realized this scheme isn't secure CCA secure if the key k2 is known. I also read the paper On the Security of Multiple Encryption or CCA-security+CCA-security=CCA-security? but wasn't too successful in understanding all the concepts listed in the paper. Any hints or idea on this will be extremely helpful. Thanks!
