I am trying to understand the notion of left-or-right-CPA (LOR-CPA) security for private-key encryption schemes introduced in my lecture. If I understood it correctly so far, the only difference to the standard IND-CPA game is that the encryption oracle always encrypts either the left or the right given message and that the attacker can query the oracle as often as it likes. I am given the following game definition: 1. Generate key by running KeyGen $k \leftarrow KeyGen(1^n)$ 2. Choose random hidden bit $h \leftarrow \{0,1\}$ 3. Prepare an oracle $O_{LOR}$ called left-or-right oracle. When called with $m_0, m_1 \in M$ returns $c \leftarrow Enc_k(m_h)$ 4. Call attacker A with $1^n$, attacker outputs two messages $m_0, m_1$ of same length 5. Call $O_{LOR}$ that returns $c \leftarrow Enc_k(m_h)$, give c to A, and await guess h' 6. If h' = h ACCEPT, else REJECT My questions are: - In what sense is this security notion stronger than the notion of IND-CPA security? - Doesn't the standard IND-CPA game also always encrypts the left or the right message, dependent on the hidden bit?