Editing Chosen-plaintext attack (section)

== General method of an attack ==
A general batch chosen-plaintext attack is carried out as follows {{Failed verification|date=February 2019}}:
# The attacker may choose ''n'' plaintexts. (This parameter ''n'' is specified as part of the [[attack model]], it may or may not be bounded.)
# The attacker then sends these ''n'' plaintexts to the encryption oracle.
# The encryption oracle will then encrypt the attacker's plaintexts and send them back to the attacker.
# The attacker receives ''n'' ciphertexts back from the oracle, in such a way that the attacker knows which ciphertext corresponds to each plaintext.
# Based on the plaintext–ciphertext pairs, the attacker can attempt to extract the key used by the oracle to encode the plaintexts. Since the attacker in this type of attack is free to craft the plaintext to match his needs, the attack complexity may be reduced.

Consider the following extension of the above situation. After the last step, 
# The adversary outputs two plaintexts {{var|m}}<sub>0</sub> and {{var|m}}<sub>1</sub>.
# A bit {{var|b}} is chosen uniformly at random <math>b\leftarrow\{0,1\}</math>.
# The adversary receives the encryption of {{var|m}}<sub>b</sub>, and attempts to "guess" which plaintext it received, and outputs a bit {{var|b'}}.

A cipher has '''indistinguishable encryptions under a chosen-plaintext attack''' if after running the above experiment the adversary can't guess correctly ({{var|b}}={{var|b'}}) with probability non-[[Negligible function|negligibly]] better than 1/2.<ref name="modern" />