ciphertexts

The ciphertexts will, in part, contain p₁⊕k and p₂⊕k, where k is the keystream and ⊕ is XOR.

Basically it means that you should be authenticating your ciphertexts.

One more thing worth mentioning is that a direct comparison of ciphertexts doesn't work for semantically secure schemes.

In this case, ciphertexts can be easily decrypted by taking the eth root of the ciphertext over the integers.

The 7-round attack 37 requires only 218 chosen plaintexts and ciphertexts and needs 38 267.5 encryptions.

You generally don't want to trust the confidentiality of a cryptosystem that doesn't check ciphertext integrity and rule out manipulated ciphertexts.

It's there to make sure that ciphertexts are understood in the correct context, but it's not included in the ciphertext itself.

This might not be a big deal, since the AES ciphertexts will seem random anyway.

Giving the untrusted server the ability to determine whether two ciphertexts will destroy the semantic security of the scheme, by definition.

An attacker can XOR those ciphertexts together and get p₁⊕k⊕p₂⊕k = p₁⊕p₂⊕k⊕k = p₁⊕p₂.

Back on the topic of this thread: Keyczar authenticates all symmetric ciphertexts by default.

Giving the attacker two ciphertexts, where their plaintexts are related by a simple function, sounds like the sort of thing that breaks cryptosystems.

Statements like "gpg ciphertexts with RSA 1024 were returned as fails" are totally meaningless.

* The way the adaptive attack (where you bounce repeated and different ciphertexts off the target and learn from each "experiment" to select the next one) builds from the simpler attack.

I prefer this one: "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis" "The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts.