# KPA-Security definition

In cryptography there are 4 basic attack classifications:

• Ciphertext-Only Attack
• Known-Plaintext Attack
• Chosen-Plaintext Attack
• Chosen-Ciphertext Attack

In Katz & Lindell's textbook (2nd edition) I only found definitions for COA-,CPA- and CCA-Security. I couldn't find a definition and experiment for KPA-Security. In general I wasn't able to find a good definition.

My questions:

• Can someone provide me good definition and experiment?
• Why is KPA-Security so unimportant? (I know that CPA-Sec includes KPA-Sec)
• Is there a use case for KPA-Security? Does an symmetric encryption scheme exist, that has KPA-Security but not CPA-Security and how would this look like?

• Per Katz and Lindell 3rd ed. section 7.2. "In a known-plaintext attack, the attacker is given pairs of inputs/outputs $$\{(x_i,F_k(x_i))\}$$ (for an unknown key $$k$$), with the $$\{x_i\}$$ outside the attackers control." KPA is the usual attack model for linear cryptanalysis, but is insufficient for differential cryptanalysis where we need each input to match up with another specific fixed input. Take any simple linear analysis of a block cipher and it should only use the KPA property.
• Another question I have: Is the security definition and experiment from Katz & Lindell for multiple encryptions ($PrivK_{A,\Pi}^{mult}(n)$) a definition/experiment for KPA-security? Oct 28, 2021 at 11:16
• In $\mathrm{PrivK}^{\mathrm must}_{A,\Pi}(n)$ in section 3.4.1of K&L: no this is not a KPA experiment. Part 1 of the experiment allows the adversary to generate the inputs and this can be done in a controlled way. Oct 28, 2021 at 11:48