In the security game between the challenger and the adversary for the security definition of public key encryption, the challenger creates and gives the public key pk to the adversary. The adversary chooses two messages of equal length $m_0$ and $m_1$ and asks the challenger to encode these. Finally, the adversary has to guess which message was encoded.

Isn't it always possible for the adversary to do this, since she knows the public key and can simply use the encryption algorithm to create the ciphertexts for both the messages and output the one which matches the challenger's reply?

I was using Dan Boneh's course to study crypto: enter image description here


1 Answer 1


In public-key cryptography, the adversary is indeed able to create encryptions of their chosen messages $m_1$ and $m_2$ on their own.

This is why any IND-CPA-secure public-key cryptosystem cannot be deterministic. That is, two encryptions of the same plaintext must produce different ciphertexts with overwhelming probability. Otherwise an adversary could, as you noted, easily win the IND-CPA game with an advantage of 1.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.