Definition of ciphertext security If I got it right, chosen ciphertext security implies also CPA security. In other words, attacker can submit plaintexts to the challenger (along with ciphertexts).



I do not understand why encryption system (E,D) where D(k,0)=0 is considered as ciphertext secure.

Imagine CPA security game where an attacker just submits two plaintexts, m0 = 0 and m1 = (any value != 0). In that case if poor challenger returns 0 then we are certain that we're in experiment 0 and win CPA game.

What I am missing here?
The important thing to note here is that $\mathsf{D}(k,0)=0$ does not necessarily imply that $\mathsf{E}(k,0)=0$. That is the reason why your attack does not work in general.

To illustrate, let $(\mathsf{E},\mathsf{D})$ be a CCA secure encryption scheme.
We then construct a new encryption scheme $(\mathsf{E'},\mathsf{D'})$ as follows:
$$\mathsf{E'}(k,m) = 1\Vert \mathsf{E}(k,m)$$ and
$$\mathsf{D'}(k,b\Vert c) = \left\{\begin{array}{ll} 0&amp; \text{if } b = 0\\ \mathsf{D}(k,c)&amp; \text{if } b = 1\end{array}\right.$$

It is trivial to show via reduction that $(\mathsf{E'},\mathsf{D'})$ inherits the CCA security from $(\mathsf{E},\mathsf{D})$, but still it has the property that $\mathsf{D'}(k,0)=0$.

As you can see, your attack does not work, because $0$ is never encrypted to $0$ by the challenger.