No fixed-construction reduction from CCA1 security to CCA2 security

Conditional · against fixed-construction reductions · assuming CCA1 Security · BDPR98

Statement

If an IND-CCA1-secure PKE scheme exists, then there is a PKE scheme that is IND-CCA1-secure but not IND-CCA2-secure, so the identity map is no reduction from CCA1 to CCA2 security — BDPR98.

Sketch

Given an IND-CCA1-secure $\mathsf{PKE}=(\mathsf{KeyGen},\mathsf{Enc},\mathsf{Dec})$, let ${\mathsf{Enc}}^{\prime }(\mathsf{pk},m)=\mathsf{Enc}(\mathsf{pk},m)\Vert 0$ and let ${\mathsf{Dec}}^{\prime }(\mathsf{sk},c\Vert \beta )=\mathsf{Dec}(\mathsf{sk},c)$ ignore the appended bit $\beta$. A CCA1 adversary against ${\mathsf{PKE}}^{\prime }$ yields one against $\mathsf{PKE}$ that strips the bit from each Phase-1 query and appends $0$ to $c^{\ast }$; a CCA2 adversary flips the last bit of $c^{\ast }$, queries ${\mathsf{Dec}}^{\prime }$ on the result, which differs from $c^{\ast }$, and receives $m_b$ — standard.

Notes

• The converse holds for every scheme: CCA2 security ⇒ CCA1 security — folklore.