The essential differences between IND-CCA1 and IND-CCA2?

Question

For some encryption scheme $(\mathcal{E}, \mathcal{D})$:

In the definition of IND-CCA, the adversary $\mathcal{A}$ can access the decryption oracle $\mathcal{D}$. The deep reason of this setting is to make sure that our scheme is able to "protect the ciphertexts" (e.g. the integrity and authenticity).

So "protecting the ciphertexts" is what an IND-CPA secure scheme can not offer. And that's why IND-CCA is stronger than IND-CPA. Furthermore, IND-CCA2 allows $\mathcal{A}$ to make queries to $\mathcal{D}$ after $\mathcal{A}$ receives the challenge ciphertext $c^{*}$, which is so called "adaptive" query.

Then my question is:

• How should we describe this distinctive ability of resisting adaptive queries in IND-CCA2, in a pellucid way ?

In other words, "random bits-like ciphertexts" leads to IND-CPA security, "the protection of ciphertexts" leads to IND-CCA1 security. Then what leads to IND-CCA2 security?

Thanks in advance!

Answer 1

IND-CCA1 is INDistinguishability under Chosen Ciphertext Attack.

IND-CCA2 is INDistinguishability under adaptive Chosen Ciphertext Attack.

In both, an adversary attempts to decipher a ciphertext $C$ by making queries to a decryption oracle that will decrypt anything. The difference is that in IND-CCA1, the queries are made without knowledge of $C$ (given to adversary after the queries), when in IND-CCA2 queries can be made with knowledge of $C$ (given to adversary early on, with prohibition to give $C$ to the decryption oracle).

IND-CCA1 models a decryption device temporarily made available to adversaries. IND-CCA2 makes that permanent.

Here are situations where IND-CCA2 encryption is desirable:

• There's a server that decrypts, then parses the deciphered plaintext as a (message, signature) pair and checks it against a public key (unrelated to the encryption/encryption key). If OK, the server acts according to message; otherwise it outputs "I won't do " message.
• Embassy A knows it's messages to B are intercepted by E and relayed (with the prefix INTERCEPT) encrypted to F; F deciphers then relays what starts with INTERCEPT to G, that A has penetrated. This puts A in an IND-CCA2 situation to attack the cipher from E to F (within the restriction that A can only submit messages starting with INTERCEPT).
• There's a server that decrypts, then remove padding, and a timing attack allows to know how much padding was removed.