# Basic CPA walkthrough

My professor put this on the slides but gave us very little context. It is meant to be an overview of how it works at a high level.

I have a programming background and I get the general idea of attacks like Chosen Plaintext Attack. Be warned I am terrible at maths!

Request: I hope someone can walk through what this is doing step by step in English. Please refer to the lecture slide.

Other questions:

1. What does the '.' dot symbol mean in the ChosenPlaintext(.) part?
2. What is a and b storing?
3. If a=b goto ... is this checking length or if both are the same text?

What I think is happening: It checks if chosen plaintext a is equal to b and if true then quit the program. Else it sets m to the chosen plaintext a. It uses ChosenPlaintext(m) to encrypt it and assign returned ciphertext to c. For some reason, it does XOR next but I am lost...

This slide came before, hopefully it provides better context:

• What is the context of this slide? This looks like a the "code" for a chosen plaintext attack on some encryption scheme, knowing the scheme and its (custom?) naming conventions could help. – SEJPM Aug 4 '19 at 14:52
• @SEJPM Check second picture I just posted, it was the slide before. – plagiarism Aug 4 '19 at 14:59

What does the '.' dot symbol mean in the ChosenPlaintext($$\cdot$$) part?

It means that you, the adversary, may call this function with any value replaced for $$\cdot$$. This is useful if you want to give the adversary access to a partially applied function, e.g. $$E(K,\cdot)$$ the pre-keyed encryption function so that the adversary gets to see encrytions without learning the key.

I hope someone can walk through what this is doing step by step in English.

You should really ask the person having presented / created this or their support staff for confirmation, but I think the idea of the slide is to give you some intution of common operations that an adversary might do and not lay out any specific concrete adversary.

• If a=b goto ..., an adversary may commonly check / compare the content of two self-computed variables, e.g. when attacking a stream cipher which suffers from IV-reuse $$a$$ may be the keystream from one chosen plaintext-ciphertext pair and $$b$$ the keystream from the challenge ciphertext XORed with $$m_0$$. The goto is just there to show that adversaries can skip execution steps / break out of loops if some condition holds.
• Else m=a, a default action to be taken when a previous if did not hold, e.g. to preserve loop-invariants.
• c=ChosenPlaintext(m), the adversary may ask for encryptions of arbitrary data before and after submitting the challenge messages. This could e.g. be useful when the encryption function is stateful if you want to force a specific state for the challenge query.
• d=c XOR b, the adversary may want to make computations on query results and / or other variables.
• If 1=1 then m0=a, m1=b the adversary may select their challenge messages conditionally based on previous computations.
• c=ChallengeCiphertext(m0,m1) the adversary can submit (once) a pair of messages to get the challenge ciphertext.
• d=ChosenPlaintext(m0) submitting challenge messages to the encryption oracle is a totally fine thing for the adversary to do and may actually break deterministic schemes.
• Return 1 and halt, the adversary can just return a fixed value, or some variable content or some expression and decide to stop execution.