Assume that we have a symmetric encryption scheme $\Pi_s$ that is IND-CCA secure in the standard model. Does this imply that $\Pi_s$ is IND-CCA in QROM?

  • $\begingroup$ I think the IND-CCA of $\Pi_s$ in the standard model implicitly says that the implementation of $\Pi_s$ does not use the random oracle (or at least independent to security proof), and thus IND-CCA in QROM as well (because the security of the scheme is independent to RO). Could you clarify the application in your mind? $\endgroup$
    – Hhan
    Oct 12, 2021 at 5:57


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.