I am reading this paper, which in the introduction, tells about two main types of key recovery SCAs :

  • Reaction_type SCAs, which uses a decryption failure oracle
  • Message-recovery-type SCAs, which uses a plaintext-checking oracle

I don't understand the difference between these two oracles. In this presentation, the authors categorize three different oracles, including these two.

My understanding is that a plaintext-checking oracle takes a ciphertext $c$ and a plaintext $m$ and returns 1 if the decryption of $c$ gives $m$, and 0 otherwise.

Regarding decryption failure oracle, it returns 0 if the decryption has failed, 1 otherwise. I don't understand if this oracle only takes a ciphertext $c$ or also a plaintext $m$. This is really unclear to me.


1 Answer 1


From what I understood in the presentation, there are two ways to compromise the mentioned PQ Algorithms. Both use maliciously crafted Cipher Texts but either recover Secret Keys or the Plain Text

  • 1
    $\begingroup$ Did you mean neither (attack) recovers secret keys or the plaintext? $\endgroup$
    – kodlu
    Jan 18 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.