Combining public key signature schemes and private key encryption I'm working on my bachelor thesis and I have some questions.
I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable signature scheme but I think it doesn't matter). The resulting scheme should be CCA-secure.
How can I do that? 

If I use a MAC instead of the signature scheme, I get a CCA-secure scheme, but I have to use signatures, since I'm in a juristic context.
I tried to combine both schemes them by signing the message and then encrypting the signature together with the message. But I struggle with proving that such a scheme is CCA-secure. CCA Security is only defined for private-key encryption schemes or public key encryption schemes but I have to prove it for the combination of priv key encr. and pub key signatures.

So my questions are:


How can I combine an unforgeable Public key signature scheme with a CPA secure private key encryption scheme, such that the resulting scheme is CCA secure?
How can I prove CCA Security for such a scheme, since it is not defined?
I tried to combine both schemes them by signing the message and then encrypting the signature together with the message. But i struggle with proving that such a scheme is CCA-secure.


I believe that the reason you're running into issues proving that is that CCA-secureness of this system doesn't actually follow from the CPA-security of the cipher and the unforgability of the signature.  That is, you could design a CPA-secure cipher that, with unforgable signatures, that the system is not CCA-secure.

Consider a CPA-secure encryption where the attacker can modify the ciphertext in a way such that the decryption of the modified ciphertext might result in the original plaintext, or might not (and whether it does or not would give the attacker information on the secret key).  CPA-secure allows such a vulnerability, as it doesn't consider modified ciphertexts.

It's fairly obvious how a CCA-attacker would break such a system; they would modify the ciphertext, and give it to the decryption oracle.  The decryptor would first recover the signed plaintext; if it was the original signed plaintext, then the signature algorithm would accept it (because it's not a forgery if it's bitwise identical to a previously signed text), and so the decryption oracle would emit the plaintext.

You could place additional constraints on the CPA-encryption to ensure this doesn't happen.  However, a better approach (both from a provability standpoint, and from an implementation standpoint) is to reverse the order of operations; first CPA-encrypt the plaintext, and then sign it.  I believe you'll find that easy to prove CCA-secure.