Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security.

The most common ones are the "IND-" ones, advertising security against specific classes of attackers.
Now these notion may not be that well-understood by many people so I ask hereby for a canonical answer, that explains what the following security notions mean. A (simple) description of the formal attack scenario is preferred.
Please don't restrict the answer to "you can chose this and if you can break it with this it isn't IND-CCA2". Please at least outline the formal attack (like f.ex. real-or-random). Relations between the "IND-" are explained (f.ex. IND-CCA implies IND-CPA).
The notions in question are:

  • IND-CCA1
  • IND-CCA2
  • IND-CCA3
share|improve this question
Where have you seen IND-CCA3? $\;$ –  Ricky Demer 2 days ago
@RickyDemer, not that often. Until now, only every now and then in some papers. The first paper to mention it was this one I think. –  SEJPM 2 days ago
Another notion is IND-CCA1. $\;$ –  Ricky Demer 2 days ago
@RickyDemer, added. The answer will have to clarify that it's the same as IND-CCA (AFAIK). –  SEJPM 2 days ago
No, I don't think it is a duplicate. You will not necessarily understand the precise meaning of IND-CPA just because you know what is meant by a Chosen Plaintext Attack, etc –  Henrick Hellström 2 days ago

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.