Paper 2003/174

Relaxing Chosen-Ciphertext Security

Ran Canetti, Hugo Krawczyk, and Jesper Nielsen


Security against adaptive chosen ciphertext attacks (or, CCA security) has been accepted as the standard requirement from encryption schemes that need to withstand active attacks. In particular, it is regarded as the appropriate security notion for encryption schemes used as components within general protocols and applications. Indeed, CCA security was shown to suffice in a large variety of contexts. However, CCA security often appears to be somewhat {\em too strong:} there exist encryption schemes (some of which come up naturally in practice) that are not CCA secure, but seem sufficiently secure ``for most practical purposes.'' We propose a relaxed variant of CCA security, called {\sf Replayable CCA (RCCA)} security. RCCA security accepts as secure the non-CCA (yet arguably secure) schemes mentioned above; furthermore, it suffices for most existing applications of CCA security. We provide three formulations of RCCA security. The first one follows the spirit of semantic security and is formulated via an ideal functionality in the universally composable security framework. The other two are formulated following the indistinguishability and non-malleability approaches, respectively. We show that the three formulations are equivalent in most interesting cases.

Available format(s)
Public-key cryptography
Publication info
Published elsewhere. An extended abstract of thiswork appears in the proceedings of Crypto 2003.
Contact author(s)
canetti @ us ibm com
2003-08-19: received
Short URL
Creative Commons Attribution


      author = {Ran Canetti and Hugo Krawczyk and Jesper Nielsen},
      title = {Relaxing Chosen-Ciphertext Security},
      howpublished = {Cryptology ePrint Archive, Paper 2003/174},
      year = {2003},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.