What is/are difference(s) among eavesdropper attack, multiple message attack and CPA attack in context of symmetric key encryption?

I only know that in eavesdropper attack there is an adversary which can send only 2 msgs to challanger and adversary has to distinguish between these in order to win the game but in multi. msg. attack & CPA, it can 2 msg vectors of same length and adversary has to distinguish between these in order to win the game.

  • $\begingroup$ I guess you refer to public key encryption? $\endgroup$ – DrLecter Mar 21 '14 at 7:50
  • $\begingroup$ No. I was reading it in context of symmetric key encryption. $\endgroup$ – user2771151 Mar 21 '14 at 8:53
  • $\begingroup$ Ok, can you edit your question to make that explicit, because that makes a difference. $\endgroup$ – DrLecter Mar 21 '14 at 8:58
  • 1
    $\begingroup$ @figlesquidge: The answer you point does not cover the distinction between eavesdropper attack and multiple messages attack (or even mention these terms), at least for the sense I suggest for that in my answer (single versus multiple use of key). Also the definition given there for Known Ciphertext Attack does not match any standard game (that I know), which clearly is the context of the question; and for sure it does not match the game in the question, where the adversary chooses the plaintexts of the eavesdropper attack. $\endgroup$ – fgrieu Mar 21 '14 at 14:43
  • $\begingroup$ @user2771151: I think you might find this question related. $\endgroup$ – Cryptographeur Mar 21 '14 at 15:02

If we try to make an equivalent to these terms in intuitive cryptography (before its formalization into games became the norm)

  • In an eavesdropper attack, the assumption is that an adversary only intercepts a single ciphertext for any given key (and, perhaps, knows the plaintext except for a small portion).
  • In a multiple messages attack, the assumption is that an adversary intercepts multiple ciphertexts enciphered under the same key (and, perhaps, knows the corresponding plaintexts except for a small part of one); that happens in practice, where keys are reused.
  • In a Chosen Plaintext Attack, the assumption is as above, plus an adversary can obtain ciphertext for any plaintext submitted (typically: iteratively; that is, the adversary can submit a new message on the basis of ciphertext obtained earlier); that models an attacker dropping a message in an embassy's letterbox, hoping that it will be sent enciphered to the Department of State for analysis.

Different games model that in the current approach of cryptography. Theses games are typically designed for worst-case scenario, and a typical game for said eavesdropper attack is as follows (and summarized in the question):

  • the adversary chooses any two distinct plaintexts (yet that game is not intended to model Chosen Plaintext Attack; that choice is here to demonstrate that whatever knowledge the adversary may have of the message space won't help);
  • the challenger chooses a key at random, enciphers one of the two messages chosen at random, and gives the ciphertext;
  • the adversary bets on which of the two plaintexts was enciphered.

If an (algorithm (with cost polynomial to the number of bits in the key size) for an) adversary exists that succeeds with odds in excess of 50% (by some fixed $\epsilon>0$), the encryption is broken. This model is realistic (and I would say the only such one) for a relatively practical situation: enciphering the result of a referendum, using a key dedicated to that sole purpose.

There are different, more complex games that model the other attacks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.