I'm confused with words adversary and challenger, that are used in proof of security of some cryptosystems. For example, adversary and challenger appear in the formal definitions of IND-CPA, IND-CCA, etc.

What are typical roles of adversary and challenger?

From my understanding, adversary refers to a player who tries to break the system while challenger refers to a player who provides something but does not try to break the system.

Are these correct?

Also, I'm wondering why challenger is not called as helper since it does not try to break the system. Rather, it is there to help the proof. The word challenger seems like an attacker.

  • 2
    $\begingroup$ The challenger is the one who challenges the adversary to e.g. distinguish data. $\endgroup$
    – forest
    Jun 17, 2019 at 6:22

2 Answers 2


Suppose you are a member of a mailing list or of an anonymous cryptographic site. Now suppose there is some "new guy" who just joined and makes bold claims about having broken some cryptosystem. Now of course because you don't know anything about the "new guy" you don't believe them. Naturally they're really insistent, so you agree to challenge their claim that the cryptosystem is broken. This makes you, the skeptical person, the challenger.

Of course because the other is trying to break the cryptosystem they're the adversary against which the cryptosystem tries to hold up. Now of course you, the challenger, know that a total and complete break of any cryptosystem (e.g. ciphertext-only attack) is an unrealistic capture of the reality, so you agree to provide the adversary with some ressources, e.g. answering requests for encryptions.

So in a sense security games are protocols that allow adversaries to convince challengers that they broke a security property in the most reproducible and convincing way (e.g. because the adversary clearly at no point has access to the key).


A challenger is an entity to whom we are trying to prove our identity or the validity of our data. Usually, it starts by sending a request for communication for example to the challenger. It then sends what we call a "challenge" for us to sign or perform a particular operation on it, using our secret. When we send back the answer to the challenger, he will know that we alone possess this secret key, and no one other than us could have computed the answer. This way we proved our identity by using the challenge proposed by the challenger (We are called the prover). The challenger is not a helper since it does not offer any help to the prover. It just asks him to respond correctly to its challenge to prove its identity. If the prover responds incorrectly, then the challenger will assume the invalidity of the prover's identity or data.

An adversary on the other hand, is just a malicious entity who is trying to prevent the users of the cryptosystem from achieving their goal. This could be by the adversary discovering the secret, corrupting some data, spoofing identity, ...

So you could say that a challenger is a participant in the cryptosystem. While an adversary is an intruder trying to break it. You can look more into Zero-Knowledge Proof as on of the examples to understand more the role of the challenger.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.