Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Can every CCA-secure cryptosystem be used as a CMA-secure MAC?
I know that every CCA-secure system is CPA-secure, but I'm not sure about CMA. From what I understand: for a system to be CCA-secure, it must be both CPA and CMA-secure. So I feel if it is known that the system is CCA-secure then it might be used as a CMA-secure MAC, but not too sure and any insight on this would be appreciated. Thanks!
Let $(\mathsf{KGen},\mathsf{Enc},\mathsf{Dec})$ be a CCA secure encryption scheme. I'm assuming you're asking about the following construction of a MAC $(\mathsf{KGen'},\mathsf{Mac},\mathsf{Vfy})$:
$$\mathsf{KGen'}(1^n) := \mathsf{KGen}(1^n) \qquad \mathsf{Mac}(k,m) := \mathsf{Enc}(k,m) \qquad \mathsf{Vfy}(k,m,\tau) := (\mathsf{Dec}(k,\tau) \stackrel{?}{=} m)$$
If that is what you're asking about, then no. This construction is generally not even unforgeable under a no-message attack. Let $m^*$ be some arbitrary fixed message from the encryption scheme's message space. We can construct a new encryption scheme $(\overline{\mathsf{KGen}},\overline{\mathsf{Enc}},\overline{\mathsf{Dec}})$ as
$$\overline{\mathsf{KGen}}(1^n) := \mathsf{KGen}(1^n) \quad \overline{\mathsf{Enc}}(k,m) := 1\|\mathsf{Enc}(k,m) \quad \overline{\mathsf{Dec}}(k,b\|c) := \begin{cases}\mathsf{Dec}(k,c) & \text{if } b=0\\ m^* & \text{otherwise}\end{cases}$$
It is easy to show that this scheme is also CCA secure, but I will leave this as an exercise to the reader. It is however trivial to forge the above MAC when instantiated with this scheme. Just output $m^*,0^{\ell(n)+1}$, where $\ell(n)$ is the length of a ciphertext under $\mathsf{Enc}$.
