# How to construct a variable length IND-CPA cipher from a fixed length one?

Suppose we can construct a secure (IND-CPA) encryption scheme for fixed length messages. I was wondering if there is a natural way to extend this construction for messages of variable length such that it is still an IND-CPA secure scheme.

-
Modes of operation are the way to do it. –  mikeazo Oct 16 '12 at 23:22
You don't need modes of operation if you already have IND-CPA security (they're designed for pseudorandom functions). If you already have IND-CPA security, you can encrypt a long message bitwise and concatenate the resulting ciphertexts (analogous to ECB mode). –  Mikero Oct 17 '12 at 2:17

If you want a real variable length, you loose the IND-CPA security:

You have to make all possible ciphertexts equally long, so that the attacker can not distinguish between the longest possible message and a 1 bit message. If maximum length is not known at the key generation, your ciphertexts would need unlimited length.

If you allow the attacker to know the message length (this isn't IND-CPA anymore), you can choose any kind of encoding (e.g. blockwise or arithmetically) and apply encryption on each part individually.

-
According to this and this, for the IND-CPA game, the messages are by definition of equal length. Where have you seen otherwise? –  mikeazo Oct 17 '12 at 17:18
@mikeazo: The Wikipedia page about Ciphertext indistinguishability doesn't contain the word length, though this might be a mistake there. –  Paŭlo Ebermann Oct 22 '12 at 20:04
@Paulo, right, I noticed that too, which is why I linked to the semantic security page instead. The second link is probably the more authoritative of the two. –  mikeazo Oct 22 '12 at 22:16
That's how the CPA game works. $\:$ (Otherwise no cipher could CPA-securely handle arbitrary input lengths.) –  Ricky Demer Oct 17 '12 at 7:27