Plaintext Awareness
Plaintext awareness (PA) requires that any algorithm producing a valid ciphertext "knows" the corresponding plaintext — an extractor can recover the plaintext from the algorithm’s state.
Purpose
It gives encryption a strong security guarantee: PA2 + IND-CPA ⟹ IND-CCA2, used to prove CCA security.
Mechanism
PA1: plaintext can be extracted from ciphertexts generated via the encryption oracle; PA2: even with a decryption-oracle history, newly generated ciphertexts still allow extraction. PA2 means the attacker cannot construct a ciphertext of unknown plaintext, and combined with IND-CPA it yields IND-CCA2.
Use cases
- CCA security proofs
- Encryption security strengthening
- Provable security