Chosen-Ciphertext Attack
In the chosen-ciphertext attack model the adversary can submit arbitrary ciphertexts and obtain the corresponding plaintexts (a decryption oracle); it is the strongest standard model (IND-CCA2).
Purpose
It defines security against active attackers who can query the decryption oracle, the security level required for real-world deployment.
Mechanism
The adversary has access to a decryption oracle D_K(·) (the challenge ciphertext excepted); IND-CCA2 requires the challenge ciphertext’s plaintext to remain indistinguishable. Padding oracle attacks are instances of CCA1.
Use cases
- Highest security standard for public-key encryption
- Padding oracle attacks
- IND-CCA2 definitions