chosen ciphertext attack security

Definition

An encryption scheme $(E,D)$ is chosen ciphertext attack (CCA) secure if every efficient adversary Mallory wins in the following game with probability at most $1/2+negl(n)$:

• Mallory gets $1^n$ where $n$ is the length of the key

• For $poly(n)$ rounds, Mallory gets access to the functions m↦Ek(m)m↦Ek​(m) and c↦Dk(c)c↦Dk​(c).

• Mallory chooses a pair of messages {m0,m1}{m0​,m1​}, a secret bb is chosen at random in {0,1}{0,1}, and Mallory gets c∗=Ek(mb)c∗=Ek​(mb​).

• Mallory now gets another poly(n)poly(n) rounds of access to the functions m↦Ek(m)m↦Ek​(m) and c↦Dk(c)c↦Dk​(c) except that she is not allowed to query c∗c∗ to her second oracle.

• Mallory outputs b′b′ and wins if b′=bb′=b.

#incomplete

References

1. https://intensecrypto.org/public/lec_06_CCA.html