View source for Symmetric Encryption (SE)

<noinclude>
[[Category:Primitives]]
[[Category:Minicrypt]]

A [[Symmetric Encryption (SE)]] scheme is a [[primitive]] that allows someone to encrypt plaintext into a ciphertext under a key and then to decrypt the ciphertext under the same key. It is a widely used primitive with many formal definitions of strengths.

== Formal Definition ==

=== Syntax ===
A [[Symmetric Encryption (SE)]] scheme is a tuple of functions <math>(\mathsf{Gen}, \mathsf{Enc}, \mathsf{Dec})</math>, with respect to a keyspace <math>\mathcal{K}</math>, plaintext space <math>\mathcal{M}</math>, and ciphertext space <math>\mathcal{C}</math>, such that:
* <math>\mathsf{Gen}(1^{\lambda}) \to k</math>, is a randomized function that takes a security parameter, and outputs a key <math>k\in \mathcal{K}</math>,
* <math>\mathsf{Enc}_k(m) \to c</math>, is a randomized function that takes a key <math>k\in \mathcal{K}</math> and plaintext message <math>m\in \mathcal{M}</math>, and outputs a ciphertext <math>c\in \mathcal{C}</math>,
* <math>\mathsf{Dec}_k(c) \to m</math>, is a deterministic function that takes a key <math>k\in \mathcal{K}</math> and ciphertext <math>c\in \mathcal{C}</math>, and outputs a plaintext message <math>m\in \mathcal{M}</math>.

=== Chosen Plaintext Attack (CPA) Security ===
<span id="CPA-security"></span>
A SE scheme is ''CPA-secure'' if for all efficient adversaries <math>A</math>, there exists a negligible function <math>\nu</math>, such that
<center><math>
\big| \Pr [A^{\mathsf{LR}_{k,b}}(1^{\lambda}) = b] - 1/2\big| \le \nu(\lambda),
</math></center>
where <math>k\gets \mathsf{Gen}(1^{\lambda})</math>, <math>b</math> is a uniformly random bit, and <math>\mathsf{LR}_{k,b}(m_0,m_1) = \mathsf{Enc}_k(m_b)</math>.

=== Chosen Ciphertext Attack (CCA) Security ===
<span id="CCA-security"></span>
A SE scheme is ''CCA-secure'' if for all admissible efficient adversaries <math>A</math>, there exists a negligible function <math>\nu</math>, such that
<center><math>
\big| \Pr [A^{\mathsf{LR}_{k,b},\mathsf{Dec}_k}(1^{\lambda}) = b] - 1/2\big| \le \nu(\lambda),
</math></center>
where <math>k\gets \mathsf{Gen}(1^{\lambda})</math>, <math>b</math> is a uniformly random bit, and <math>\mathsf{LR}_{k,b}(m_0,m_1) = \mathsf{Enc}_k(m_b)</math>. Further, we say an adversary is admissible if it never queries <math>\mathsf{Dec}_k</math> on an output of <math>\mathsf{LR}_{k,b}</math>.

The difference in this definition is that we additionally give the adversary access to a decryption oracle. This is a strictly stronger definition than [[SE#CPA-security]].

=== Indistinguishable from Random CPA (IND-CPA) Security ===
<span id="IND-CPA-security"></span>
A SE scheme is ''IND-CPA-secure'' if for all efficient adversaries <math>A</math>, there exists a negligible function <math>\nu</math>, such that
<center><math>
\big| \Pr [A^{\mathsf{Enc}_{k}}(1^{\lambda}) = 1] - A^{R}(1^{\lambda}) = 1]\big| \le \nu(\lambda),
</math></center>
where <math>k\gets \mathsf{Gen}(1^{\lambda})</math> and <math>R</math> is a random function from <math>\mathcal{M}\to\mathcal{C}</math>.

This security definition is also a stronger definition than CPA-security as it additionally restricts the distribution of ciphertexts produced by an encryption algorithm.

== Relationship to other primitives ==
* [[PRF]]s imply the existence of CPA-secure [[SE]]s [[folklore]]

== Sufficient assumptions ==
See the sufficient assumptions for [[OWF]]s.

== Variations ==
* [[Authenticated Encryption]]
* [[Public Key Encryption (PKE)]]

== Other Notes ==
* Other security definitions, named CCA1 and CCA2, exist and have historically been confused with the CCA notion outlined above