I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security introduced in my lecture. If I understood it correctly so far, the only difference to the standard IND-CPA game is that the encryption oracle always encrypts either the left or the right given message and that the attacker can query the oracle as often as it likes.

I am given the following game definition:

1. Generate key by running KeyGen $k \leftarrow KeyGen(1^n)$

2. Choose random hidden bit $h \leftarrow \{0,1\}$

3. Prepare an oracle $O_{LOR}$ called left-or-right oracle. When called with $m_0, m_1 \in M$ returns $c \leftarrow Enc_k(m_h)$

4. Call attacker A with $1^n$, attacker outputs two messages $m_0, m_1$ of same length

5. Call $O_{LOR}$ that returns $c \leftarrow Enc_k(m_h)$, give c to A, and await guess h'

6. If h' = h ACCEPT, else REJECT

My questions are:

• In what sense is this security notion stronger than the notion of IND-CPA security?
• Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?

I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to the standard IND-CPA game is that the encryption oracle always encrypts either the left or the right given message and that the attacker can query the oracle as often as it likes.

I am given the following game definition:

1. Generate key by running KeyGen $k \leftarrow KeyGen(1^n)$

2. Choose random hidden bit $h \leftarrow \{0,1\}$

3. Prepare an oracle $O_{LOR}$ called left-or-right oracle. When called with $m_0, m_1 \in M$ returns $c \leftarrow Enc_k(m_h)$

4. Call attacker A with $1^n$, attacker outputs two messages $m_0, m_1$ of same length

5. Call $O_{LOR}$ that returns $c \leftarrow Enc_k(m_h)$, give c to A, and await guess h'

6. If h' = h ACCEPT, else REJECT

My questions are:

• In what sense is this security notion stronger than the notion of IND-CPA security?
• Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?