Plaintext-aware encryption

Plaintext-awareness is a notion of security for <a href="/facts/Public-key_encryption/gowoFTxS">public-key encryption</a>. A <a href="/facts/Cryptosystem/GyDVJ4D0">cryptosystem</a> is plaintext-aware if it is difficult for any efficient <a href="/facts/Algorithm/fnl5NmRt">algorithm</a> to come up with a valid <a href="/facts/Ciphertext/luNTs4sY">ciphertext</a> without being aware of the corresponding <a href="/facts/Plaintext/tWnBDCgE">plaintext</a>.
From a lay point of view, this is a strange property. Normally, a ciphertext is computed by <a href="/facts/Encryption/16q29Fdv">encrypting</a> a plaintext. If a ciphertext is created this way, its creator would be aware, in some sense, of the plaintext. However, many cryptosystems are not plaintext-aware. As an example, consider the <a href="/facts/RSA_(algorithm)/XTzyfHuq">RSA cryptosystem</a> without padding. In the RSA cryptosystem, plaintexts and ciphertexts are both values <a href="/facts/Modular_arithmetic/0wtRa5dU">modulo</a> N (the modulus). Therefore, RSA is not plaintext aware: one way of generating a ciphertext without knowing the plaintext is to simply choose a random number modulo N.
In fact, plaintext-awareness is a very strong property. Any cryptosystem that is <a href="/facts/Semantic_security/PlW18aEh">semantically secure</a> and is plaintext-aware is actually secure against a <a href="/facts/Chosen-ciphertext_attack/l9fL7fYR">chosen-ciphertext attack</a>, since any adversary that chooses ciphertexts would already know the plaintexts associated with them.

Plaintext-aware encryption open-in-new

Plaintext-aware encryption