# What are the capabilities of passive and active adversaries?

I have trouble understanding what exactly the capabilities of passive and active adversaries are on paper and in the real world.

An important question is, "how strong is strong enough?" The answer is complicated and has given way to several varying degrees of strength. Most security models are described as a game between you and the adversary. One such model is chosen plain-text attack. That is, suppose the adversary Eve is given oracle access to a black box decryption algorithm. That is, she can ask for the encryption of $$m_1,...,m_k$$ for some reasonable number of $$k$$ to get cipher texts $$c_1,...,c_k.$$. The adversary then picks two messages $$m_0^*,m_1^*$$ and is given the encryption of one of the two messages chosen uniformly at random $$c_b$$ where $$b\in\{0,1\}$$. If the adversary can correctly guess if $$b=0$$ or $$b=1$$ with greater than $$1/2$$ probability, then the adversary wins.
Now suppose Eve is allowed to change messages in transit. That is, suppose you are logging on to the Bank of America, and you ow me \$100. If I am Mallory (the name given to an active adversary), I can flip some bits of the message in transit and hope that my changes make the amount larger. Or worse, I could throw out your message and inject my own! Now you went from paying me \$100 to \\$1000. We, of course, want to prevent this.