I recently acquired Katz & Lindell's Introduction to modern cryptography (3d edition). Currently I'm on page 27 where we have the following definition:

Definition 2.3: An encryption scheme (Gen, Enc,Dec) with message space $M$ is perfectly secret if for every probability distribution for $M$, every messgage $m \in M$, and every ciphertext $c \in C$ for which $Pr[C=c] > 0$: $$Pr[M=m|C=c]=Pr[M=m]$$

The explanation above it mentions:

The adversary can eavesdrop on the parties' communication, and thus observe this ciphertext. (That is, this is a ciphertext-only attack, where the attackers sees only a single ciphertext).


  1. Why is perfect security defined under the threat model of an eavesdropper (ciphertext-only attack)? Shouldn't perfect security be defined under a CCA (chosen-ciphertext attack) threat model?
  2. Is the one-time pad perfectly secret under a CCA threat model?
  • $\begingroup$ @kelalaka I read through it again and I'm not seeing it. $\endgroup$
    – Mr. B
    Commented Apr 16 at 10:08
  • $\begingroup$ Dear friend, attaining perfect secrecy is hard since it requires key size >= message size and is still malleable. If we assume that OTP has a state (OTP has Ind-CPA), I don't see a reason that it cannot achieve CCA, just follow the steps of the link. The answer is long, and I've no time for that. $\endgroup$
    – kelalaka
    Commented Apr 17 at 21:00

1 Answer 1


Perfect secrecy is about confidentiality (secret = confidential), and the weakest setting where it makes sense is in a ciphertext only attack. The other attacks are stronger, namely chosen ciphertext attack is the strongest and then the chosen plaintext attack.

As soon as you allow the attacker the power to modify something, i.e., either the plaintext or the ciphertext you are in a setting where integrity is also part of the security primitives of interest. In these settings, and for these stronger attacks, clearly perfect secrecy is no longer a sufficient measure for security. And if you only care about secrecy, it can still be achieved in these settings, if you forego integrity.

  • 1
    $\begingroup$ I wrote an answer, however, I've seen that it will be long for me ( still waiting to discard). OTP can achieve Ind-CPA and as far as I can see, it can achieve Ind-CCA, too if the same pad is never used ( nom nom). The biggest handicaps are key size and malleability which requires integrity protection... $\endgroup$
    – kelalaka
    Commented Apr 16 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.