CCA Security ⇒ CCA1 Security

Fully-black-box reduction · standard model · folklore · security loss: tight — the adversary and its advantage are unchanged

Statement

Every CCA2-secure PKE scheme is CCA1-secure: a CCA1 adversary is a CCA2 adversary that makes no decryption queries after receiving $c^{\ast }$, so its CCA2 advantage equals its CCA1 advantage — folklore.

Notes

• BDPR98 prove the implication formally and show it is strict: if a CCA1-secure scheme exists, one exists that is not CCA2-secure (CCA1 ⇏ CCA2).