how to prove that given cryptosystem is not IND-CCA secure?
Given two plaintexts x1; x2 and a ciphertext (y1; y2) where y1 = f(r) and y2 = G(r) xor xi
for a random i(1,2) a CCA can query the decryption of (y1; ~y) where ~y != y2. Upon
receiving the answer x, the attacker can recover G(r) = ~y xor x. Then the attacker can
compute xi = G(r) xor y2 and find i.