Ашық мәтінді білу қағидаты және асимметриялық шифрлеу

Plaintext awareness is a notion of security for public key encryption. A cryptosystem is plaintext aware if it is difficult for any efficient algorithm to come up with a valid ciphertext without being aware of the corresponding plaintext. From a lay point of view, this is a strange property. Normally, a ciphertext is computed by encrypting a plaintext. If a ciphertext is created this way, its creator would be aware, in some sense, of the plaintext. However, many cryptosystems are not plaintext aware. As an example, consider the RSA cryptosystem without padding. In the RSA cryptosystem, plaintexts and ciphertexts are both values modulo N (the modulus). Therefore, RSA is not plaintext aware: one way of generating a ciphertext without knowing the plaintext is to simply choose a random number modulo N.

In fact, plaintext awareness is a very strong property. Any cryptosystem that is semantically secure and is plaintext aware is actually secure against a chosen ciphertext attack, since any adversary that chooses ciphertexts would already know the plaintexts associated with them.

The concept of plaintext aware encryption was developed by Mihir Bellare and Phillip Rogaway in their paper on optimal asymmetric encryption, as a method to prove that a cryptosystem is chosen ciphertext secure.

Limited research on plaintext aware encryption has been done since Bellare and Rogaway's paper. Although several papers have applied the plaintext aware technique in proving encryption schemes are chosen ciphertext secure, only three papers revisit the concept of plaintext aware encryption itself, both focussed on the definition given by Bellare and Rogaway that inherently require random oracles. Plaintext aware encryption is known to exist when a public key infrastructure is assumed. Also, it has been shown that weaker forms of plaintext awareness exist under the knowledge of exponent assumption, a non standard assumption about Diffie Hellman triples. Finally a variant of the Cramer Shoup encryption scheme was shown to be fully plaintext aware in the standard model under the knowledge of exponent assumption.