# Encryption Oracle Avoidance

I have a case where it may be possible for an adversary to deduce the plaintext inputs that went into creating a AES-128-GCM encrypted message (there is good IV diversity across the encrypted messages, however) This opens up the potential to expose a GCM "oracle" to the adversary who may additionally be able to adaptively modify the inputs to the encryption function and observe the GCM encrypted outputs. I'm thinking about adding a random string of bytes of some fixed length to each encrypted message in order to prevent this (since an attacker would no be able to guess the random bytes that were appended and would therefore not know the full plaintext for a corresponding ciphertext). Some questions: 1) Can someone provide a "rule of thumb" around how much randomness should be appended to each message of a given length. 2) Does one need to take particular care around how the random byes are added an removed from the message 3) Are there any other methods one can employ in order to avoid exposing the encryption "oracle" described above?

• A couple of questions: (1) Is it safe to assume that its OK to provide an encryption oracle to a CPA adversary so long as the encryption scheme $\pi$ has the property that for multiple encryptions $Pr[PrivK^{LR cpa}_{\mathcal{A},\pi}(n)=1]≤1/2+negl(n)$ (in the notation of Lindell and Katz),i.e, its safe to provide an oracle so long as the scheme is CPA secure for multiple encryptions, (2)If not, what is the exact definition that tells me when it's secure to expose an encryption oracle to a CPA adversary (3)for a CPA secure scheme, adding authentication additionally provides CCA security ? – Rohit Khera Jan 27 '16 at 0:56