# Why is a non fixed-length encryption scheme worse than a fixed-length one?

I have the following definition (highlights by me):

An (efficient secret-key) encryption scheme $(Gen,Enc,Dec)$, where $Gen$ and $Enc$ are PPT algorithms and $Dec$ is a Deterministic Polytime Algorithm, is one-time computationally-secret if for any PPT adversary $A$ it holds that the probability of the following experiment is negligibly biased from $1/2$:

1. The adversary outputs two messages $m_0$ and $m_1$ of the same length.
2. Let $k \leftarrow Gen(1^n)$ and let $b \in {0,1}$ be chosen uniformly at random. $c \leftarrow Enc_k(m_b)$ is computed and given to $A$
3. A outputs the bit $b'$
4. The output of the experiment is 1 $\iff b'=b$

I wonder why $m_0$ and $m_1$ should be of the same length, why is better than considering a non-fixed length encryption scheme?

The only drawback that comes to my mind is that if you are able to know something about the encryption of two messages of different length before they are actually encrypted (note that the key is generated in Step 2) then it would justify the choice of fixed-lenght. But I cannot think of a reason why it must be so.

Any ideas?

-

The encryption scheme in the experiment you describe does not have to be fixed-length. We simply require that the two messages the adversary sends to its oracle have the same length. The restriction is on the adversary, not on the encryption algorithm.

So why do we put this requirement on the adversary? The reason is that in every practical encryption scheme, ciphertexts leak information about the length of the corresponding plaintexts --- the longer the plaintext, the longer the ciphertext. So cryptographers basically threw their hands up in the air and said, "Fine, we'll just concede that length-information leaks. Can we make sure no other information leaks?" Requiring the lengths of $m_0$ and $m_1$ to be the same ensures that the adversary can't guess which one was enrypted simply by looking at the length of the ciphertext it gets back. Therefore the experiment you describe measures an adversary's ability to find some other way that information leaks.

-
I am not sure about the part of the length of the corresponding ciphertext: note that in the Definition I gave above the Encryption algorithm $Enc$ is a PPT algorithm, therefore we know that $\forall n$ (security parameter) $\forall m$, $||Enc(m)|| < l(||k||+||m||)$, where $l(x) \in \mathbb{Z}[X]$, so we know that the length (i.e. the number of bits, denoted by $||\cdot||$ ) is polynomially bounded, so I don't think we can say that we know the length of the corresponding ciphertext... –  Alan Bletchley Oct 24 '12 at 19:10