Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In CPA model, we assume Eve has access to an oracle who has the correct key and Eve can send query to the oracle to encrypt in CPA the data.

Assume this encryption algorithm is a plain ECB mode AES and eve knows about it, i.e., if Eve plug in a key to AES-ECB and apply the same data for encryption twice, Eve will be able to distinguish that the ciphertext is not random across two encrytions with the same key.

However, let's say Eve can gain a few ciphertexts that is encrypted with the real key from the cipher oracle and he knows the plaintexts corresponding to these ciphertexts. However, Eve cannot control the plaintext value. Then the key is removed from the cipher oracle and the cipher oracle will never encrypt anymore plaintexts.

But Eve can plug in any key Eve likes after the real key is removed. So do we still say such a system is subject to CPA attack? NOTE: his goal is to obtain information about the plaintext.

share|improve this question
Does the key Eve uses stay constant once she has chosen it? – mikeazo Nov 20 '15 at 20:34
@mikeazo, kindly check my edit – dannycrane Nov 20 '15 at 21:32
Eve can always encrypt using any key she chooses. So what you are describing is essentially a standard known-plaintext attack scenario. – otus Nov 20 '15 at 22:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.