# Why do the messages in IND-CPA have to be of same length

I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always exist a successful attack and therefore CPA security would not exist. Can anyone guide me into a direction on how such an attack would look like?

• One does not want to impose the requirement that schemes need to hide the message length (because that would probably end up being suuuuuuper inefficient).
– SEJPM
Jul 19 '17 at 8:31

Here is an outline of such a distinguisher would work; if you submit a one byte plaintext, then the resulting ciphertext length will follow some probability distribution (with many ciphers, it will be one fixed length; we'll consider the more general case where it is probabilistic); for this probability distribution, we'll have some $N$ where the probability of the length being less than $N$ is $\ge 0.75$.
So, we submit two plaintexts; one consisting of 1 byte, and the other consisting of $N+1$ random bytes. If the ciphertext corresponds to the short plaintext, the ciphertext will be of length $< N$ with probability $> 0.75$; if the ciphertext consists to the long plaintext, the ciphertext will be of length $< N$ with probability at most $\frac{1}{256}$ (can be shown by the pigeon-hole principle); hence just looking at the length of the ciphertext can serve as the distinguisher.
• @Gilrich: I specifically said that the long message was 'random', that is, randomly chosen out of the $256^{N+1}$ possible messages of length $N+1$. We assume that the encryption method is invertible; that is, for any ciphertext, there is at most 1 plaintext message that can map to it. There are $\sum_{i=0}^N 256^i = (256^{N+1}-1)/255$ ciphertext messages of length $N$ or shorter; hence the probability that a random long plaintext message can map to a ciphertext message of length $N$ or shorter must be less than $1/255$ (I said $1/256$, well, that's a minor error) Jul 20 '17 at 17:21