I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs :
- Reaction_type SCAs, which uses a decryption failure oracle
- Message-recovery-type SCAs, which uses a plaintext-checking oracle
I don't understand the difference between these two oracles. In this presentation, the authors categorize three different oracles, including these two.
My understanding is that a plaintext-checking oracle takes a ciphertext $c$ and a plaintext $m$ and returns 1 if the decryption of $c$ gives $m$, and 0 otherwise.
Regarding decryption failure oracle, it returns 0 if the decryption has failed, 1 otherwise. I don't understand if this oracle only takes a ciphertext $c$ or also a plaintext $m$. This is really unclear to me.