Chosen plaintext vs Chosen ciphertext

What is the difference between chosen plaintext and chosen ciphertext attack? In both of these adversary has access to paintext-ciphertext pairs.Then where lies the difference?

The difference is how the plaintext-ciphertext pairs that the attacker has access to are generated.

• In a chosen plaintext attack, the attacker chooses some plaintext and is handed the corresponding ciphertext. In other words, the attacker may encrypt arbitrary messages.
• In a chosen ciphertext attack, the attacker can additionally (a chosen ciphertext attack is usually understood to subsume a chosen plaintext attack) choose some ciphertext and is handed the corresponding plaintext. In other words, the attacker may encrypt and decrypt arbitrary messages.

(Note: usually, additional restrictions on the permitted messages are posed in a particular security game to make it "fair", since some notions of security are vacuous if the attacker can query really arbitrary messages.)

• Do we even see chosen ciphertext in practice? – Pacerier Feb 16 '15 at 23:15
• @Pacerier: Yes, we do. The POODLE attack on SSL is an example for this: en.wikipedia.org/wiki/POODLE and further openssl.org/~bodo/ssl-poodle.pdf – Nova Apr 6 '15 at 6:51
• But aren't both of those still the same? If the decrypted cipher text is presumably the same as the plain text, can't the chosen plaintext attack assume to also know the decrypted cipher text, and therefore have the same data available as the chosen ciphertext attack – Eddie May 23 '16 at 17:41
• Unless.. in a chosen ciphertext attack the attacker can modify the cipher text and "see if it decrypts" when ran through the decryption function? In which case, I can see the difference. – Eddie May 24 '16 at 17:40
• @yyyyyyy is chosen ciphertext a subset of known plaintext/ciphertext attacks? – Trey Feb 21 '18 at 19:46

In chosen plain-text attacks the adversary can obtain the encryption of plain-texts of its choice. In chosen cipher-text attacks can obtain the decryption of any cipher-text (Katz & Lindell, 2008). Technically a chosen-ciphertext should be called a chosen-cipher text and plain text attack (Ferguson, Schneier, & Kohno, 2010) however, that name would be too long. The difference is in chosen cipher text attacks you have access to both plain texts and cipher texts. The chosen cipher-text attacks is more powerful as a result of the manner in which it can find corresponding plain texts and cipher texts. There is a higher probability of finding the secret key with a chosen cipher text attack than a chosen plain-text attack.

• Should chosen-plaintext not also give you plain- and ciphertext? You chose the plaintext and get the appropiate ciphertext. – Nova Dec 26 '14 at 3:29
• No, Nova these are two different types of attacks with different emphases. There is a nuanced difference: in Chosen-Plaintext attacks you only choose plain texts to possibly find cipher texts. Chosen Cipher is actually more robust because you choose both plain texts and cipher texts as well. There is more freedom and ways to generate a cipher text/plain text statistical test, table or frequency chart. The book Cryptography Engineering discusses this in a straight forward fashion and Introduction to Modern Cryptography more abstractly. – Jacob E Mack Dec 26 '14 at 3:41
• I know that that are two different attacks, but as far as I understand your answer, in both attacks you get plaintext-ciphertext pairs, one with chosen plaintexts and one with chosen ciphertexts. – Nova Dec 26 '14 at 3:43
• Please see my edited reply above, sorry not clear at first Here is the exact quite from Cryptography Engineering on p. 32, pr. 5: "Obviously, the chosen-cipher text is more powerful than a chosen-plain text attack, as the attacker has more freedom." – Jacob E Mack Dec 26 '14 at 3:47
• Please see here with Thomas's reply, as he explains it wonderfully: crypto.stackexchange.com/questions/13274/… – Jacob E Mack Dec 26 '14 at 3:49

in Chosen plaintext , plaintext message chosen by cryptanalyst with its corresponding ciphertext but in chosen ciphertext chosen by cryptanalyst with its corresponding plaintext.