Таңдалған қара мәтінге шабуыл: шифрларды талдау моделі

Attack model for cryptanalysis with presumed access to ciphertexts for chosen plaintexts

A chosen plaintext attack (CPA) is an attack model for cryptanalysis which presumes that the attacker can obtain the ciphertexts for arbitrary plaintexts. The goal of the attack is to gain information that reduces the security of the encryption scheme. Modern ciphers aim to provide semantic security, also known as ciphertext indistinguishability under chosen plaintext attack, and they are therefore, by design, generally immune to chosen plaintext attacks if correctly implemented.

In a chosen plaintext attack the adversary can (possibly adaptively) ask for the ciphertexts of arbitrary plaintext messages. This is formalized by allowing the adversary to interact with an encryption oracle, viewed as a black box. The attacker’s goal is to reveal all or a part of the secret encryption key. It may seem infeasible in practice that an attacker could obtain ciphertexts for given plaintexts. However, modern cryptography is implemented in software or hardware and is used for a diverse range of applications; for many cases, a chosen plaintext attack is often very feasible (see also In practice). Chosen plaintext attacks become extremely important in the context of public key cryptography where the encryption key is public and so attackers can encrypt any plaintext they choose.

A chosen plaintext attack is more powerful than known plaintext attack, because the attacker can directly target specific terms or patterns without having to wait for these to appear naturally, allowing faster gathering of data relevant to cryptanalysis. Therefore, any cipher that prevents chosen plaintext attacks is also secure against known plaintext and ciphertext only attacks. However, a chosen plaintext attack is less powerful than a chosen ciphertext attack, where the attacker can obtain the plaintexts of arbitrary ciphertexts. A CCA attacker can sometimes break a CPA secure system. For example, the El Gamal cipher is secure against chosen plaintext attacks, but vulnerable to chosen ciphertext attacks because it is unconditionally malleable.