Commonly there are four ways to "break" a secrecy-focused cryptosystem:
- Recover the secret key
- Recover the message
- Distinguish an encryption from random noise
- Distinguish the encryption of two different messages
The practical implications of the first two breaks are obious: They allow arbitrary message recovery (more or less) fast.
However I'm unclear about the practical implications of the the last two breaks.
So let's assume an encryption algorithm or a public key cryptosystem which fails to provide indistinguishability but also doesn't allow key or message recovery. As an example assume the scheme from the "Present an attack for the combination of OTP and textbook RSA" question under a chosen plaintext attack.
What are the practical implications if a distinguishable cryptosystem would be used in practice?