Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?

  • 1
    $\begingroup$ I think the IND-CCA of $\Pi_s$ in the standard model implicitly says that the implementation of $\Pi_s$ does not use the random oracle (or at least independent to security proof), and thus IND-CCA in QROM as well (because the security of the scheme is independent to RO). Could you clarify the application in your mind? $\endgroup$
    – Hhan
    Commented Oct 12, 2021 at 5:57


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.