# Is this scheme CPA or/and EAV secure

Let F be a pseudorandom function (length preserving). We have the following scheme: To encrypt $$m \in \{0,1\}^{2n}$$, parse m as $$m_1||m_2$$ with $$|m_1|=|m_2|$$, then choose $$r\leftarrow\{0,1\}^n$$ and output the ciphertext $$(r, m_1\oplus F_k(r), m_2 \oplus F_k(r))$$. Is this scheme EAV secure? I think that it is not EAV secure because we use twice the pseudorandom function with the same r, but I can not prove it formaly.

• What happens if you try to xor some of the ciphertext components? – Maeher Nov 25 '20 at 9:56
• Note that you don't need much of a proof to show insecurity. The system is EAV or CPA secure if every P.P.T. adversary has negligible advantage. If you find an adversary that has non-negligible advantage, this suffices for a formal proof of insecurity – 0kp Nov 25 '20 at 12:35