I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also read that it is semantically secure when it meets the DDH assumption. Is there some terminology I'm misunderstanding because that seems contradictory to me.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Finding the corresponding $m'$ using $c'$ is a chosen cipher text attack. It's possible for a scheme to be semantically secure under certain types of attacks (perhaps something weaker like chosen-plaintext attack), but be broken under heavier attacks (like the chosen ciphertext attack you talk about).