# How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also read that it is semantically secure when it meets the DDH assumption. Is there some terminology I'm misunderstanding because that seems contradictory to me.

-

Finding the corresponding $m'$ using $c'$ is a chosen cipher text attack. It's possible for a scheme to be semantically secure under certain types of attacks (perhaps something weaker like chosen-plaintext attack), but be broken under heavier attacks (like the chosen ciphertext attack you talk about).