What is the difference between chosen-plaintext attack and adaptive-chosen-plaintext attack?

Question

I've just dived in cryptography and would like to learn basics of this science.

Currently I can't understand the difference between these two types of attacks. As I understood from Bruce Schneier's book "Applied Cryptography", adaptive-chosen-plaintext attack is similar to chosen chosen-plaintext attack, but cryptanalyst can modify his choice (plaintext) based on previously got result.

What does this suppose to mean? In chosen-plaintext attack cryptanalyst also is choosing the plaintext. So what is the difference?

Answer 1

With chosen-plaintext attack, the attacker is allowed to choose an arbitary amount of plaintext to encrypt. After that he/she can't do that again, he/she has to work with the current data.

With the adaptive-chosen-plaintext attack, he/she can do the same as with the chosen-plaintext attack, but is also allowed to encrypt new data after the attacker has looked and analyzed previous encrypted bits. He/she can, based on the already encrypted data, choose new data to further advance his/her attack.

Answer 2

In CPA, you should choose the set of plaint texts that you want to encrypt before passing it to algorithm. where as in adaptive CPA, you can choose the plaint texts on the go.

Answer 3

The simplest way to demonstrate the difference is with an encryption scheme that is deliberately broken to an adaptive-chosen-plaintext attack.

Take any encryption scheme. Now lets add a stupid testing/validation feature. If the first 4 characters of the input is "test", it takes the next byte as a bit-length value. Then it takes that number of following bits from the plaintext and compares it to the leading bits of the key. This there is an exact match then the encryption code adds a "Test passed" flag to the output.

With a one-shot chosen plaintext attack, the attacker can either set the bitlength to 1 and determine the first bit of the key, or they can use a higher bitlength length trying to exactly guess more bits, with a rapidly vanishing probability of success. In either case they have hit a brick wall if they cannot crack the remaining bits.

With an adaptive plaintext attack they can start with a test bitlength of 1 to learn the first bit of the key, and each subsequent plaintext can increase the test length to determine each subsequent bit of the key.