🔐Chosen-Plaintext Attack

NEW

Also known as: CPA

Cryptanalysis model where an attacker obtains ciphertexts for chosen plaintexts to infer information about the encryption.

DESCRIPTION

In a chosen-plaintext attack, adversaries submit selected plaintexts to an encryption oracle and analyze resulting ciphertexts. Security definitions like IND-CPA formalize resistance to such attacks. Many modern schemes are proven IND-CPA or stronger. Implementation flaws (e.g., padding oracles) can enable practical CPA variants. Defense includes constant-time implementations, authenticated encryption, and avoidance of deterministic encryption.

ALTERNATIVE DEFINITIONS

Wikipedia

In cryptography, a chosen-plaintext attack (CPA) is an attack model for cryptanalysis where the attacker chooses arbitrary plaintexts to be encrypted and obtains the corresponding ciphertexts.

Defines CPA as an attack model enabling chosen inputs and corresponding outputs.

Source

NIST Computer Security Resource Center

An attack in which the adversary can choose the plaintext to be encrypted and obtain the corresponding ciphertext.

Concise definition emphasizing attacker capability and oracle access.

Source

RELATED TERMS

Known-Plaintext Attack Ciphertext-Only Attack Adaptive Chosen-Plaintext Attack IND-CPA IND-CCA Cryptanalysis Padding Oracle Attack Oracle Side-Channel Attack

COMPETING TERMS

Chosen-Ciphertext Attack

RELATIONS

• Broader: Cryptanalysis

KNOWLEDGE AREAS

Data Security Software Engineering

TARGET AUDIENCE

Chief Information Security Officer Security Architect Cybersecurity Engineer Software Developer Data Privacy Officer

EXTERNAL SOURCES

• Wikipedia - Chosen-plaintext attack
• IETF Internet Security Glossary - Glossary entry for CPA
• Adam Langley - AE and CPA discussion

TOP QUESTIONS

Why is Chosen-Plaintext Attack relevant to modern cryptography?

Most security definitions assume CPA-capable adversaries. Schemes must be IND-CPA secure at minimum to withstand realistic attack scenarios.

Category: Relevancy

How does CPA differ from CCA?

CPA allows chosen plaintext queries to an encryption oracle; CCA additionally allows chosen ciphertext queries to a decryption oracle.

Category: Misunderstanding

What prevents CPA exploitation in practice?

Randomized encryption, authenticated encryption, and proper key management mitigate CPA feasibility.

Category: Requirements

Are deterministic ciphers vulnerable to CPA?

Deterministic encryption leaks equality of plaintexts under CPA and must be used only with constrained threat models.

Category: Risks

Is CPA realistic in typical systems?

Yes, APIs often expose encryption services, enabling adversaries to craft inputs and observe outputs.

Category: Opinion

What is IND-CPA security?

Indistinguishability under chosen-plaintext attack ensures ciphertexts do not reveal which of two chosen messages was encrypted.

Category: Definition

Do padding oracle attacks relate to CPA?

Padding oracles often escalate to CCA, but they begin with crafting inputs and observing responses, akin to CPA methodology.

Category: Example

How should developers test for CPA robustness?

Use vetted AEAD libraries, avoid homegrown crypto, and perform code reviews and penetration tests focusing on crypto APIs.

Category: Testing

Which protocols target CPA resistance?

TLS 1.3 uses AEAD ciphers providing IND-CPA and integrity, reducing exploit surfaces for CPA.

Category: Overview