Attack model (cryptography)

Common attack models

• Ciphertext-only attack: the adversary has access only to one or more ciphertexts and attempts to infer the plaintext or the key. This is the weakest practical model and historically describes many passive eavesdropping scenarios. See ciphertext-only attack.
• Known-plaintext attack: the attacker knows one or more plaintexts and their corresponding ciphertexts (for example, standard headers or predictable protocol fields) and uses that knowledge to recover keys or decrypt further messages. See known-plaintext attack.
• Chosen-plaintext attack (CPA): the adversary can obtain ciphertexts for plaintexts they select, typically via an encryption oracle. CPA models are central when proving indistinguishability under chosen-plaintext attack (IND-CPA). See chosen-plaintext attack.
• Chosen-ciphertext attack (CCA): the attacker has access to a decryption oracle for chosen ciphertexts (with some restrictions) and tries to break the system; many practical attacks exploit CCA access to reveal keys or decrypt protected messages. See chosen-ciphertext attack.

There are important refinements. An adaptive chosen-ciphertext attack (often called CCA2) allows the attacker to decide each next query based on previous oracle responses, whereas a non-adaptive or "indifferent" variant fixes queries in advance. These distinctions matter: a scheme secure against CPA may still be vulnerable to CCA. Modern public-key protocols usually aim for IND-CCA security because many realistic environments give attackers decryption-like capabilities (for example, error messages from a server).

History and role in modern cryptography

Attack models evolved from classical codebreaking practice—where analysts used known fragments and statistical structure—to formal definitions in the late 20th century that enable rigorous proofs. Theoretical frameworks (IND-CPA, IND-CCA) tie an algorithm's security to a specified attacker model so designers can prove resilience under well-defined assumptions. Famous practical breaks, such as padding oracle attacks against RSA-based schemes, illustrate how a seemingly minor decryption oracle can undermine security when an attacker has CCA-like access.

Uses, examples, and practical importance

Security goals in standards and protocols are stated with respect to attack models: for instance, authenticated encryption aims to prevent both ciphertext modification and forgery even under chosen-ciphertext attacks. Examples of relevance include network eavesdropping (ciphertext-only), protocol exploitation where some plaintexts are predictable (known-plaintext), adaptive chosen-plaintext in selective-key scenarios, and server-side oracle leaks that enable chosen-ciphertext exploitation. Understanding the model helps operators choose appropriate primitives and implement safe error handling and access controls.

Notable distinctions and guidance

Stronger attacker models require stronger defenses. Designing to resist adaptive chosen-ciphertext adversaries leads to more robust constructions but may add complexity. When evaluating a system, explicitly state the assumed attack model: security claims without a model are ambiguous. For deeper reading on each variant and formal definitions, follow the labeled entries for ciphertext-only, known-plaintext, chosen-plaintext, chosen-ciphertext and related materials for the role of the cryptanalyst and the encrypted message.