In a description of IND-CPA (indistinguishability under the chosen plaintext attack), I have been reading the following, simple test:
The adversary can generate as many messages as he wants. Then, he chooses two messages $m0$ and $m1$, those messages are encrypted, and one of the ciphertexts is sent back to him. The adversary should not be able to guess which message was used to generate that ciphertext.
Is that really the correct way to do an IND-CPA test?
I would imagine that — if I were the adversary and you the crypto-guru — I would pick and send you a one-liner saying "Hello world" and a copy of the front page of a news-paper article consisting of at least 100 words. Whatever you'll send me back encrypted will allow me to differ and identify the ciphertext as the average encryption won't pad that one-liner to the same length as the news-paper article. There's a pretty good chance that the newspaper article's cryptotext will be bigger than the one-liner's cryptotext.
Following that logic, it would mean that most (if not all) crypto currently used would fail that IND-CPA test.
Is that quoted test wrong or missing something?