# Security Goal Indistinguishability

I am currently reading a book called Serious Cryptography written by Aumasson to learn about Security. There was a paragraph talking about the security goal named indistinguishability (attached below), which reads in the section "Security Goals":

I've informally defined the goal of security as "nothing can be learned about the cipher's behavior." To turn this idea into a rigorous mathematical definition, cryptographers defined two main security goals that correspond to different ideas of what it means to learn something about a cipher's behavior:

• Indistinguishability (IND) Ciphertexts should be indistinguishable from random strings. This is usually illustrated with this hypothetical game: if an attacker picks two plaintext and then receives a ciphertext of one of the two (chosen at random), they shouldn't be able to tell which plaintext was encrypted, even by performing encryption queries with the two plaintexts (and decryption queries, if the model is CCA rather than CPA).

• Non-mallleability (NM) ...

While I understood that the point is to make it infeasible to point out which plaintext is encrypted when randomly given the ciphertext from one of 2 plaintexts.

I don't know how it is infeasible anymore when the attacker can now perform encryption/decryption queries on the given plaintexts as mentioned in the paragraph. Why can't they just encrypt both given plaintexts and then compare them with the given ciphertext?

• Given the attacker a decryption oracle on plaintext doesn't make sense; it's about decrypting arbitrary ciphertext. So that part is just put into the text in in a hurry. Wikipedia indicates that: "... with the caveat that it may not pass the challenge ciphertext for decryption (otherwise, the definition would be trivial)" for both CCA1 and CCA2. Sep 23, 2022 at 9:54
• This is our canonical Q/A on these subject; Easy explanation of "IND-" security notions? and my advice read the paper di.ens.fr/david.pointcheval/Documents/Papers/1998_crypto.pdf Sep 23, 2022 at 20:22
• (Sorry for my late response) Thank you for your resources @MaartenBodewes and kelalaka. So it turned out that the "IND-" phrase must be attached to extra terms (CPA, CCA, etc.) to retrieve a more meaningful context of the requirement. Did i understand it correctly? Sep 27, 2022 at 14:34
• Generally we expect the output of ciphers to be indistinguishable, but yes, indicating under which attack(s) the ciphers produce output that is indistinguishable from random in the output domain is important. If a cryptographer would tell me that a cipher is indistinguishable from random I´d assume the normal attack vectors for the kind of cipher. If a developer would tell me the same then I would start asking questions :) Sep 27, 2022 at 15:29

Here is a very simple scheme (you can find it in Katz & Lindell's textbook (2nd edition)), which can be proven to be CPA-secure. $$r$$ is the needed randomness and $$k$$ is the standard secret key. $$F$$ is a pseudo random functions (based on $$r$$ and $$k$$) 