I would like to know if there are some methods or techniques that can convert a public key encryption scheme from CPA secure to CCA secure?

  • 1
    $\begingroup$ See Naor-Yung and Fujisaki-Okamoto transformations. $\endgroup$
    – ckamath
    Commented Jul 23, 2021 at 5:26
  • 2
    $\begingroup$ @Occams_Trimmer Why not offer a full answer instead of just a comment? $\endgroup$
    – Patriot
    Commented Jul 23, 2021 at 10:55

1 Answer 1


There are several compilers that take a CPA-secure PKE and produce a CCA-secure PKE. I am aware of two.

The first (possibly the earliest) is the Naor-Yung transformation [NY], which uses a non-interactive zero-knowledge proof (NIKZ) for this purpose. Since we know how to construct NIZKs from a variety of hardness assumptions (e.g., quadratic residuosity, LWE etc.) and in the random-oracle model, we get CCA-secure PKE under these additional assumptions.

The second and arguably the more efficient/practical transformation is the Fujisaki-Okamoto transformation, which is proved secure in the random-oracle model. In fact, one can as well start with a OW-secure PKE.

[FO]: Fujisaki and Okamoto, Secure Integration of Asymmetric and Symmetric Encryption Schemes, JoC'13

[NY]: Naor and Yung, Public-key Cryptosystems Provably Secure against Chosen Ciphertext Attacks, STOC'90


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.