My definitions of IND-CPA and LOR-CPA call the attacker only once and instead of two phases a one-time test oracle will supply the challenge. As the left-or-right oracle is the test oracle for LOR-CPA that makes no difference here. But for IND-CPA it allows the attacker to query more encryption after receiving the challenge. This may lead to a slightly stronger security notion but I believe that the two-phase model is artificial anyways.
Now back to your question:
- In what sense is this security notion stronger than the notion of IND-CPA security?
- In what sense is this security notion stronger than the notion of IND-CPA security?
Actually, (t,e)-IND-CPA security does imply (t,l e)-LOR-CPA security where l is a bound on the number of calls to the left-or-right oracle in the LOR-CPA game. This can be proved by Yao's approach. You lose the factor l however.
In the other direction you do not lose anything (but a tiny amount of time for the reduction).
-
Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?
- Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?
No. The IND-CPA game has an oracle for encryption. It encrypts a given message but does not access the hidden bit. The attacker only has access to the hidden bit when asking for the challenge (via a one-time oracle as I prefer, or via a two-phase model as you wrote above).
To emphasize the difference: In the LOR-CPA game the attacker gets something depending on the hidden bit on every oracle call. In IND-CPA game the attacker only gets access to the hidden bit once.
