Also known as: chosen-plaintext attack, CPA

A chosen-plaintext attack (CPA) gives the attacker the power to choose the plaintexts and observe the matching ciphertexts.¹ Controlled inputs are far more informative than passively observed ones: by varying a single character, length, or bit at a time, the attacker drives the cipher’s internal state deliberately and reads its response — making it strictly stronger than a known-plaintext attack.

Choosing inputs that differ in one place isolates how that change propagates — the densest possible view of the cipher's state machine.

How it works

The attacker designs input sets that hold most of the state fixed and vary one factor: a length sweep exposes how the cipher is seeded; a single-character sweep exposes the per-position transform; single-bit differences feed directly into differential cryptanalysis. Because the inputs are chosen, the attacker can systematically cover the state×input combinations a passive corpus never reaches, often pinning an internal table outright.

Variants

Two sub-flavours differ in when the choices are made. In a batch (non-adaptive) attack the attacker fixes all plaintexts up front. In an adaptive chosen-plaintext attack (CPA2) each new query depends on the answers so far, so the attacker can zoom in — probe, look at the ciphertext, then design the next probe to resolve the remaining ambiguity. Adaptivity is what makes CPA the natural setting for interactive reverse engineering. The model also sets the modern security bar: a cipher is called IND-CPA secure when an adversary who may encrypt any plaintexts of their choosing still cannot distinguish which of two messages was encrypted — a property that requires randomised or nonce-based encryption, since a deterministic cipher always leaks when two identical plaintexts recur.²

In practice

Mounting a CPA requires the ability to inject plaintext into the target, which is often the practical obstacle. Against a stored-data cipher this may be trivial; against a live radio system it means transmitting chosen content — feasible only where you are licensed and authorized to key up. When available it is decisive, because it converts a statistics problem (hope the right pair appears) into an experiment (make the right pair appear).

Relevance to SDR

For an over-the-air obfuscation, a chosen-plaintext attack means programming a transmitter with selected text and capturing the result on an SDR — only on systems and spectrum you are licensed or authorized to key up. It is the decisive lever where passive known-plaintext data stalls: GopherTrunk’s analysis of the Motorola P25 talker-alias obfuscation (issue #773) found the per-character update is sparsely covered by real callsigns, so a short controlled sweep would supply exactly the dense coverage needed to finish it.

Sources

1. Chosen-plaintext attack — Wikipedia, for the attack model and its advantage over passively observed plaintext. ↩

2. Ciphertext indistinguishability — Wikipedia, for IND-CPA as the security notion defined against this attack model. ↩

See also

• Known-plaintext attack
• Ciphertext-only attack
• Differential cryptanalysis
• Brute-force attack (exhaustive key search)
• TETRA TEA ciphers