I know that the OTP is considered to have perfect secrecy, but I haven't seen anything about its security against chosen ciphertext attacks, and I was wondering about its secrecy in this regard. My intuition is that it shouldn't be since I'd imagine it has the same issues as CTR$ against a chosen ciphertext attack, but I am not certain.

  • 3
    $\begingroup$ OTP cannot be IND-CCA secure because it is not even IND-CPA secure. $\endgroup$
    – Mikero
    Commented Feb 23 at 4:21
  • 1
    $\begingroup$ Oh I see, from here -- it doesn't fit the definition of IND-CPA well crypto.stackexchange.com/questions/25683/… $\endgroup$
    – chemN00b
    Commented Feb 23 at 5:34
  • 1
    $\begingroup$ Wow, the answers to that question are crazy to me. I wasn't aware there was such a variety of interpretations of a statement that is (to me) 100% unambiguous. $\endgroup$
    – Mikero
    Commented Feb 23 at 6:43
  • $\begingroup$ No! See Easy explanation of "IND-" security notions?. For beyond Ind-CPA we need integrity. $\endgroup$
    – kelalaka
    Commented Feb 24 at 22:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.