Chosenciphertext

Chosen-ciphertext refers to a cryptographic attack model in which an adversary can obtain the decryption of ciphertexts of their choosing. In a chosen-ciphertext attack, the attacker interacts with a decryption oracle and submits ciphertexts for which they receive the corresponding plaintexts. The goal is to defeat the confidentiality guarantees of a cryptosystem, even when the attacker can use decryption as an oracle on many ciphertexts.

There are two main variants: non-adaptive (CCA1) where the attacker’s queries are fixed before receiving any challenge, and adaptive (CCA2) where queries can be made before and after seeing the challenge ciphertext. In the canonical security notion IND-CCA (indistinguishability under adaptive chosen-ciphertext attack), a public-key encryption scheme remains secure even when the attacker has access to a decryption oracle for arbitrary ciphertexts, with the restriction that the oracle must not decrypt the challenge ciphertext.

Examples and defenses: schemes such as RSA-OAEP and Cramer-Shoup achieve IND-CCA security in the standard model. Padding oracle attacks illustrate how insufficient integrity protections can enable CCA-like weaknesses. In symmetric encryption, authenticated encryption with associated data (AEAD) provides practical CCA-like security by ensuring ciphertexts cannot be tampered with or efficiently exploited by decryption queries.

In formal terms, an IND-CCA security game gives the adversary two messages, provides an encryption of one of them, and allows decryption queries to choose ciphertexts to decrypt (excluding the challenge). If the adversary’s advantage in identifying the encrypted message is negligible, the scheme is considered secure against chosen-ciphertext attacks.