# Tag Info

I misunderstood the question You wrote your question in a way that the adversary sees only a single ciphertext. Therefore, OTP satisfies your definition but is not CPA secure. This is probably not what you had in mind. I think you should consider a definition where $\cal A$ outputs $(m_{1,0},m_{1,1}), (m_{2,0},m_{2,1}), \ldots, (m_{n,0},m_{n,1})$ and gets ...