Chosenciphertext attack
This article includes a list of references, but its sources remain unclear because it has insufficient inline citations. (January 2011) (Learn how and when to remove this template message)

A chosenciphertext attack (CCA) is an attack model for cryptanalysis where the cryptanalyst can gather information by obtaining the decryptions of chosen ciphertexts. From these pieces of information the adversary can attempt to recover the hidden secret key used for decryption.
For formal definitions of security against chosenciphertext attacks, see for example: Michael Luby^{[1]} and Mihir Bellare et al.^{[2]}
Contents
Introduction
A number of otherwise secure schemes can be defeated under chosenciphertext attack. For example, the El Gamal cryptosystem is semantically secure under chosenplaintext attack, but this semantic security can be trivially defeated under a chosenciphertext attack. Early versions of RSA padding used in the SSL protocol were vulnerable to a sophisticated adaptive chosenciphertext attack which revealed SSL session keys. Chosenciphertext attacks have implications for some selfsynchronizing stream ciphers as well. Designers of tamperresistant cryptographic smart cards must be particularly cognizant of these attacks, as these devices may be completely under the control of an adversary, who can issue a large number of chosenciphertexts in an attempt to recover the hidden secret key.
It was not clear at all whether public key cryptosystems can withstand the chosen ciphertext attack until the initial breakthrough work of Moni Naor and Moti Yung in 1990, which suggested a mode of dual encryption with integrity proof (now known as the "NaorYung" encryption paradigm).^{[3]} This work made understanding of the notion of security against chosen ciphertext attack much clearer than before and open the research direction of constructing systems with various protections against variants of the attack.
When a cryptosystem is vulnerable to chosenciphertext attack, implementers must be careful to avoid situations in which an adversary might be able to decrypt chosenciphertexts (i.e., avoid providing a decryption oracle). This can be more difficult than it appears, as even partially chosen ciphertexts can permit subtle attacks. Additionally, other issues exist and some cryptosystems (such as RSA) use the same mechanism to sign messages and to decrypt them. This permits attacks when hashing is not used on the message to be signed. A better approach is to use a cryptosystem which is provably secure under chosenciphertext attack, including (among others) RSAOAEP secure under the random oracle heuristics, CramerShoup which was the first public key practical system to be secure. For symmetric encryption schemes it is known that authenticated encryption which is a primitive based on symmetric encryption gives security against chosen ciphertext attacks, as was first shown by Jonathan Katz and Moti Yung.^{[4]}
Varieties
Chosenciphertext attacks, like other attacks, may be adaptive or nonadaptive. In an adaptive chosenciphertext attack, the attacker can use the results from prior decryptions to inform their choices of which ciphertexts to have decrypted. In a nonadaptive attack, the attacker chooses the ciphertexts to have decrypted without seeing any of the resulting plaintexts. After seeing the plaintexts, the attacker can no longer obtain the decryption of additional ciphertexts.
Lunchtime attacks
A specially noted variant of the chosenciphertext attack is the "lunchtime", "midnight", or "indifferent" attack, in which an attacker may make adaptive chosenciphertext queries but only up until a certain point, after which the attacker must demonstrate some improved ability to attack the system.^{[5]} The term "lunchtime attack" refers to the idea that a user's computer, with the ability to decrypt, is available to an attacker while the user is out to lunch. This form of the attack was the first one commonly discussed: obviously, if the attacker has the ability to make adaptive chosen ciphertext queries, no encrypted message would be safe, at least until that ability is taken away. This attack is sometimes called the "nonadaptive chosen ciphertext attack";^{[6]} here, "nonadaptive" refers to the fact that the attacker cannot adapt their queries in response to the challenge, which is given after the ability to make chosen ciphertext queries has expired.
Adaptive chosenciphertext attack
A (full) adaptive chosenciphertext attack is an attack in which ciphertexts may be chosen adaptively before and after a challenge ciphertext is given to the attacker, with only the stipulation that the challenge ciphertext may not itself be queried. This is a stronger attack notion than the lunchtime attack, and is commonly referred to as a CCA2 attack, as compared to a CCA1 (lunchtime) attack.^{[6]} Few practical attacks are of this form. Rather, this model is important for its use in proofs of security against chosenciphertext attacks. A proof that attacks in this model are impossible implies that any realistic chosenciphertext attack cannot be performed.
A practical adaptive chosenciphertext attack is the Bleichenbacher attack against PKCS#1.^{[7]}
Numerous cryptosystems are proven secure against adaptive chosenciphertext attacks, some proving this security property based only on algebraic assumptions, some additionally requiring an idealized random oracle assumption. For example, the CramerShoup system^{[5]} is secure based on number theoretic assumptions and no idealization, and after a number of subtle investigations it was also established that the practical scheme RSAOAEP is secure under the RSA assumption in the idealized random oracle model.^{[8]}
See also
 Ciphertextonly attack
 Knownplaintext attack
 Chosenplaintext attack
 Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage (Usenix 2016)
References
 ^ Luby, Michael (1996). Pseudorandomness and Cryptographic Applications. Princeton University Press.
 ^ Bellare, M.; Desai, A.; Jokipii, E.; Rogaway, P. (1997). "A concrete security treatment of symmetric encryption". Proceedings 38th Annual Symposium on Foundations of Computer Science: 394–403.
 ^ "Moni Naor and Moti Yung, Publickey cryptosystems provably secure against chosen ciphertext attacks". Proceedings 21st Annual ACM Symposium on Theory of Computing: 427–437. 1990.
 ^ "Jonathan Katz".
 ^ ^{a} ^{b} Ronald Cramer and Victor Shoup, "A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack", in Advances in Cryptology  CRYPTO '98 proceedings, Santa Barbara, California, 1998, pp. 1325. (article)
 ^ ^{a} ^{b} Mihir Bellare, Anand Desai, David Pointcheval, and Phillip Rogaway, Relations among Notions of Security for PublicKey Encryption Schemes, in Advances in Cryptology  CRYPTO '98, Santa Barbara, California, pp. 549570.
 ^ D. Bleichenbacher. Chosen Ciphertext Attacks against Protocols Based on RSA Encryption Standard PKCS #1 Archived 20120204 at the Wayback Machine.. In Advances in Cryptology  CRYPTO'98, LNCS vol. 1462, pages: 1–12, 1998
 ^ M. Bellare, P. Rogaway Optimal Asymmetric Encryption  How to encrypt with RSA extended abstract in Advances in Cryptology  Eurocrypt '94 Proceedings, Lecture Notes in Computer Science Vol. 950, A. De Santis ed, SpringerVerlag, 1995. full version (pdf)