# CCA secure vs AE scheme

We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse.

I believe it is not true, and I am finding trouble to construct a scheme which is only CCA secure but is not an authenticated encryption.

How to show the existence of an encryption scheme which is only CCA secure but is not an authenticated encryption?

• Hint: Can you think of a scheme that yields no information about other plaintexts when decryption-queried with a new ciphertext but also never returns $\bot$? Nov 29, 2020 at 10:25

Let $$(\mathsf{Enc},\mathsf{Dec})$$ be an authenticated encryption scheme, i.e. it is both IND-CPA secure and INT-CTXT secure (and thus by extension IND-CCA secure). Let $$\mathcal{M}$$ be the message space of this encrytion scheme and let $$\hat m\in\mathcal{M}$$ be an arbitrary fixed message.
Now construct the symmetric encryption scheme $$(\mathsf{Enc}',\mathsf{Dec}')$$ with $$\mathsf{Enc}'=\mathsf{Enc}$$ and $$\mathsf{Dec}'$$ defined as
\begin{align*} &\underline{\mathsf{Dec}'(k,c)}\\ &m := \mathsf{Dec}(k,c)\\ &\textrm{if } m = \bot\\ &\quad \textrm{return } \hat m\\ &\textrm{else}\\ &\quad \textrm{return } m \end{align*}
It is easy to show that this scheme remains IND-CCA secure. The reduction to the IND-CCA security of $$(\mathsf{Enc},\mathsf{Dec})$$ merely needs to replace all $$\bot$$-responses of the decryption oracle with $$\hat m$$.
At the same time, it is trivial to break INT-CTXT security of $$(\mathsf{Enc}',\mathsf{Dec}')$$ by simply presenting literally anything as a ciphertext.