Chosen plain text and chosen ciphertext definitions clarification

Question

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition.

If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that will mean he will get a valid encryption for this message. Now according to the definition of the CCA attack the adversary should send another ciphertext not equal to the just obtained one.

What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message? Or in other words why in the definition is the attacker only allowed to send other messages.

Answer 1

The idea behind these models is to model an adversaries capabilities. To get reliable security the worst case for a capability is modelled. Let's start with chosen plaintext attacks (CPA):

In this game the adversary is given access to an encryption oracle. This models the case where an attacker knows (parts of) the message. For example, the British knew during WWII that German messages will always end with "Heil Hitler" and this was what allowed them to break their encryption. Now, as I said we always want to model the worst case, so let's assume the adversary knows the whole plaintext. For a good encryption scheme this should not give him any advantage. Besides, there might be some messages that are more beneficial to an attacker than others. A good encryption scheme should also be secure in this case. So, that's why we allow the attacker to chose the messages which are encrypted. Thereby we can make sure that even for the most beneficial message the adversary can not break the scheme.

In some cases the above might already be enough. However, sometimes it might be the case that the adversary can learn the plaintexts for some ciphertexts. For example, the decrypted values might be output by an application which the adversary can somehow access or they influence the behaviour of an application which can be observed. Hence, we might also want to cover this case. This leads to the stronger notion of security against chosen ciphertext attacks (CCA). To model the above we give the adversary access to a decryption oracle. The motivation behind allowing the adversary to decrypt arbitrary ciphertexts is the same as above, i.e. modelling the worst case.

These notions define something we call a learning phase. It models what an adversary might be able to learn about the used encryption scheme and the used keys. However, the goal of the adversary is to attack a ciphertext for which he does not know the plaintext, yet. And of course it is about a ciphertext for which he was unable to learn the plaintext from one of the above "side-channels". This is normally modelled in one of two ways. Either in terms of semantic security which says that an adversary can learn nothing about a plaintext given its ciphertext, or in terms of indistinguishability of ciphertexts (IND). Luckily, these two notions are equivalent and I will not talk anymore about semantic security as it is more complicated to explain the details.

In the case of IND, the adversary is allowed to choose two different messages. One of the two messages is chosen at random and the adversary will receive back the encryption of it. Now the goal of the adversary is to tell which message's encryption he received. As I said before, we want to model the case where the adversary is unable to learn something about the plaintext from a side channel. Hence, he is not allowed to ask its decryption oracle for the decryption of this plaintext.

Answer 2

"What prevents an attacker from just sending the received ciphertext
to the recipient who will think that this is the legitimate message?"

Nothing. $\:$ (In that case, the recipient will be correct.)

Why "in the definition" is the attacker "only allowed to send another" message?


If he knows before seeing the ciphertext that it will be an encryption of Send 100 dollars to attacker and "in the definition of the CCA attack ... not equal to just obtained one", then the attacker just made things impossible for himself by letting the challenge plaintexts be equal,
and things would remain impossible for the attacker even if the attacker could send that
ciphertext, so allowing the attacker to send that ciphertext would not affect that case.
(In CCA attacks, the attacker can send ciphertexts
from the encryption oracle to the decryption oracle.)

On the other hand, when the challenge plaintexts are not equal (to each other),
the attacker "is only allowed to send another" message because otherwise,
the definition would trivially be impossible to achieve.