# Chosen plain text and chosen ciphertext definitions clarification

I am trying to understand a concept of CPA and CCA attack and I cannot get one thing from the definition.

If an attacker can execute a CPA attack for something like Send 100 dollars to attacker that will mean he will get a valid encryption for this message. Now according to the definition of the CCA attack the adversary should send another ciphertext not equal to the just obtained one.

What prevents an attacker from just sending the received ciphertext to the recipient who will think that this is the legitimate message? Or in other words why in the definition is the attacker only allowed to send other messages.

The idea behind these models is to model an adversaries capabilities. To get reliable security the worst case for a capability is modelled. Let's start with chosen plaintext attacks (CPA):

In this game the adversary is given access to an encryption oracle. This models the case where an attacker knows (parts of) the message. For example, the British knew during WWII that German messages will always end with "Heil Hitler" and this was what allowed them to break their encryption. Now, as I said we always want to model the worst case, so let's assume the adversary knows the whole plaintext. For a good encryption scheme this should not give him any advantage. Besides, there might be some messages that are more beneficial to an attacker than others. A good encryption scheme should also be secure in this case. So, that's why we allow the attacker to chose the messages which are encrypted. Thereby we can make sure that even for the most beneficial message the adversary can not break the scheme.

In some cases the above might already be enough. However, sometimes it might be the case that the adversary can learn the plaintexts for some ciphertexts. For example, the decrypted values might be output by an application which the adversary can somehow access or they influence the behaviour of an application which can be observed. Hence, we might also want to cover this case. This leads to the stronger notion of security against chosen ciphertext attacks (CCA). To model the above we give the adversary access to a decryption oracle. The motivation behind allowing the adversary to decrypt arbitrary ciphertexts is the same as above, i.e. modelling the worst case.

These notions define something we call a learning phase. It models what an adversary might be able to learn about the used encryption scheme and the used keys. However, the goal of the adversary is to attack a ciphertext for which he does not know the plaintext, yet. And of course it is about a ciphertext for which he was unable to learn the plaintext from one of the above "side-channels". This is normally modelled in one of two ways. Either in terms of semantic security which says that an adversary can learn nothing about a plaintext given its ciphertext, or in terms of indistinguishability of ciphertexts (IND). Luckily, these two notions are equivalent and I will not talk anymore about semantic security as it is more complicated to explain the details.

In the case of IND, the adversary is allowed to choose two different messages. One of the two messages is chosen at random and the adversary will receive back the encryption of it. Now the goal of the adversary is to tell which message's encryption he received. As I said before, we want to model the case where the adversary is unable to learn something about the plaintext from a side channel. Hence, he is not allowed to ask its decryption oracle for the decryption of this plaintext.

• Thanks for additional explanations but I still did not get how this model the situation I described: when an adversary has an encryption oracle and encrypts a forged message, why he can't just use it to manipulate the server? – Ilya Chernomordik Aug 31 '15 at 7:13
• Because the goal is not to "manipulate the server", it's to break the crypto-system. So the question is more like "If the attacker have an encryption oracle, does that help him to decrypt any arbitrary ciphertext?". – Dillinur Aug 31 '15 at 11:29
• @IlyaChernomordik You seem to have fallen for the common misconception that encryption provides integrity / authenticity. That's not the case! If you want these properties you have to add a message authentication code (MAC) in the symmetric or a signature in the asymmetric setting. For plain encryption we only ask for the privacy of an encrypted message which is modelled by IND or semantic security. For that reason the above model does not include a goal for the adversary that says "forge an encryption". – mephisto Aug 31 '15 at 13:01
• What about the CCA security for the authenticated encryption? I am following Dan Boneh lections on coursera and he defined CCA security for the authenticated encryption with the same limitation of not reusing the message there... – Ilya Chernomordik Aug 31 '15 at 13:10
• Your main fault is that you do not add the security model name. The models for plain encryption are SEM-CPA, IND-CPA, SEM-CCA, IND-CCA,... here, SEM / IND describes which goal is modelled (privacy of encryption) and CPA / CCA models the capabilities of the attacker. For authenticated encryption the schemes have to fulfill additional properties like INT-CTXT which models the integrity property. However, this property has to be reached IN ADDITION to IND-CPA for example. For these models the goal is to generate a forged ciphertext that the adversary did not learn from the user... – mephisto Aug 31 '15 at 13:26

"What prevents an attacker from just sending the received ciphertext
to the recipient who will think that this is the legitimate message?"

Nothing. $\:$ (In that case, the recipient will be correct.)

Why "in the definition" is the attacker "only allowed to send another" message?

If he knows before seeing the ciphertext that it will be an encryption of Send 100 dollars to attacker and "in the definition of the CCA attack ... not equal to just obtained one", then the attacker just made things impossible for himself by letting the challenge plaintexts be equal,
and things would remain impossible for the attacker even if the attacker could send that
ciphertext, so allowing the attacker to send that ciphertext would not affect that case.
(In CCA attacks, the attacker can send ciphertexts
from the encryption oracle to the decryption oracle.)

On the other hand, when the challenge plaintexts are not equal (to each other),
the attacker "is only allowed to send another" message because otherwise,
the definition would trivially be impossible to achieve.