CCA1 Security ⇒ CPA Security

Fully-black-box reduction · standard model · folklore · security loss: tight: the adversary and its advantage are unchanged

Statement

Every CCA1-secure PKE scheme is CPA-secure: a CPA adversary is a CCA1 adversary that makes no decryption queries, so its CPA and CCA1 advantages against the same scheme coincide — folklore.

Notes

• The implication is strict: if a CPA-secure scheme exists, one exists that is CPA-secure but not CCA1-secure (CPA ⇏ CCA1) — BDPR98.