{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-12T08:41:02Z", "providers": [ "Codex" ], "breadth": "recalled by Codex without web access - no source was read", "missingProviders": [], "pass": 2, "cost": { "grok": { "seconds": 23.5, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094c5-bf3f-7171-bd3b-b82438de7186\n--------\nuser\nDescribe what is already known about one registered thing. Answer as JSON only, no prose around it.\n\nThing: chosen-plaintext attack\nSense to describe: (none recorded)\nDomain code: ACT.ACT\nAlso known as: (none)\n\n\nContext for this batch of 1001 things:\n# Batch 0", "usd": 0.0, "recall": true }, "codex": { "seconds": 80.9, "error": "Reading additional input from stdin...\nOpenAI Codex v0.153.4\n--------\nworkdir: R:\\02_PROJECTS\\02_Meta_Models_Platforms\\Ver.cy\\current\\thing-registry-backlog\nmodel: gpt-6-astra\nprovider: openai\napproval: never\nsandbox: read-only\nreasoning effort: none\nreasoning summaries: none\nsession id: 01a094c5-bf2f-75f1-95ed-43567e015725\n--------\nuser\nYou are drafting a Vercy meta-model for one registered thing. Answer as JSON only, no prose around it.\n\nThing: chosen-plaintext attack\nRegistry id: vr.tr.chosen-plaintext-attack\nPlane / domain: ACT / ACT.ACT\nRegistry definition: (none recorded)\nNames folded in" } }, "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-06T12:00:00Z", "ingestedAt": "2026-10-06T08:44:31+00:00", "fields": [ "agent_conduct", "ethics", "failure_modes_and_hazards", "owners", "visual_identification" ] }, "gate": { "passed": true, "version": "1.0", "at": "2026-10-07T10:10:29+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q2981730", "registryId": "vr.tr.chosen-plaintext-attack", "name": "chosen-plaintext attack", "version": "0.1.0-research.1", "entryKind": "thing", "family": "Thing Registry", "domain": [ "ACT.ACT" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q2981730/", "model": { "registry_id": "vr.tr.chosen-plaintext-attack", "name": "chosen-plaintext attack", "purpose": "Enable an agent to recognise a chosen-plaintext attack, assess its capabilities and demonstrated consequences, and select justified evaluation or mitigation actions.", "definition": "A chosen-plaintext attack is a cryptanalytic attack model in which an adversary can obtain encryptions of plaintexts it selects under a target key, seeking to recover secret information or violate the encryption scheme's confidentiality.", "scope_statement": "This model owns vr.tr.chosen-plaintext-attack in ACT / ACT.ACT: the attack capability and activity of selecting plaintexts and obtaining corresponding encryptions, including constrained and adaptive instances, their assumptions, evidence and outcomes.", "in_scope": [ "Attacker control over plaintexts submitted for encryption", "Encryption access and its relationship to the target key context", "Adaptive selection, query constraints and observable responses", "Confidentiality objectives and evidence of attack success", "Applicability of security claims and mitigations to the recorded attack conditions" ], "out_of_scope": [ "Encryption algorithms and protocols as independently maintained models", "Known-plaintext attacks without attacker selection of the encrypted messages", "Chosen-ciphertext attacks requiring decryption access", "Side-channel acquisition mechanisms, except as linked additional capabilities", "Complete intrusion campaigns, actor attribution and incident management" ], "distinguishing_features": [ "The attacker selects plaintext inputs and obtains their encryptions; merely observing existing plaintext-ciphertext pairs does not establish chosen-plaintext access. [Trevisan, section 2.3](https://theory.stanford.edu/~trevisan/books/crypto.pdf)", "The defining interface encrypts selected messages; an attack dependent on decrypting selected ciphertexts requires a different or combined classification.", "Chosen-plaintext access describes an adversarial capability, while a successful attack additionally requires evidence that a stated security objective was defeated.", "An adaptive instance chooses later plaintexts using earlier encryption results; a fixed collection of chosen inputs is non-adaptive.", "The selected inputs must reach an encryption context relevant to the target; encrypting them under an unrelated key does not establish the required relationship." ], "characteristics": [ { "name": "Record interpretation", "kind": "category", "unit_or_values": "threat-model capability | attack method | concrete execution", "why_it_matters": "Separates assumed access, a proposed technique and an observed event." }, { "name": "Plaintext control", "kind": "category", "unit_or_values": "complete message | selected fields | prefix | suffix | constrained message family", "why_it_matters": "Determines which chosen-input strategies are actually available." }, { "name": "Encryption access", "kind": "category", "unit_or_values": "encryption service | induced application encryption | local public-key encryption | hypothetical oracle", "why_it_matters": "Identifies how chosen messages become ciphertexts." }, { "name": "Target encryption relationship", "kind": "relation", "unit_or_values": "Links to scheme, parameter set, key-context identifier and target ciphertext set", "why_it_matters": "Establishes whether query results bear on the intended target without recording secret keys." }, { "name": "Query adaptivity", "kind": "category", "unit_or_values": "non-adaptive | adaptive | unknown", "why_it_matters": "Records whether observations can influence subsequent inputs." }, { "name": "Query expenditure", "kind": "measurement", "unit_or_values": "encryption queries, plaintext bytes and sequential rounds", "why_it_matters": "Makes resource claims comparable and exposes access limits." }, { "name": "Encryption auxiliary-input conditions", "kind": "category", "unit_or_values": "Scheme-specific randomness, nonce and IV generation, visibility, control and reuse conditions", "why_it_matters": "Determines whether an attack satisfies or violates the encryption scheme's assumptions." }, { "name": "Attack objective", "kind": "category", "unit_or_values": "message distinction | partial plaintext inference | plaintext recovery | key recovery", "why_it_matters": "Prevents a narrow confidentiality result from being reported as complete compromise." }, { "name": "Measured advantage", "kind": "measurement", "unit_or_values": "Probability difference under an explicitly named experiment and normalization", "why_it_matters": "Connects success claims to a baseline and a reproducible definition." }, { "name": "Evidence state", "kind": "state", "unit_or_values": "assumed | proposed | demonstrated | independently reproduced | inconclusive | refuted", "why_it_matters": "Distinguishes an available capability from a supported security failure." } ], "affordances": [ "Classify an observation as full, constrained or unsupported chosen-plaintext access.", "Map an attack's required oracle behavior to an actual encryption interface.", "Compare an execution with the assumptions of a stated CPA security experiment.", "Design an authorised evaluation with explicit query budgets and success criteria.", "Assess whether evidence supports distinction, plaintext recovery or key recovery.", "Identify and retest changes that address the demonstrated failure conditions." ], "agent_conduct": { "may": [ "Explain the chosen-plaintext attack model and why schemes must resist it.", "Evaluate encryption schemes against this model in authorized testing." ], "must_not": [ "Attack systems the user is not authorized to test.", "Help recover keys or plaintext from other people's encrypted data.", "Claim a scheme is secure without proper analysis under this model." ], "requires_human": [ "Disclosing a vulnerability found in a deployed system." ] }, "ethics": { "considerations": [ "Weak encryption exposes people's private data.", "Responsible disclosure protects users while flaws are fixed." ], "affected_parties": [ "Users of encrypted systems", "System operators" ] }, "owners": { "steward": "Nobody owns the model; researchers and system operators answer for its use.", "master_systems": [] }, "visual_identification": [ "Appears in security definitions and proofs, often as indistinguishability under chosen-plaintext attack." ], "failure_modes_and_hazards": [ "Schemes that fail this model leak information.", "Misuse against systems without authorization." ], "what_it_is_for": [ "The chosen-plaintext attack model is used in cryptography to evaluate confidentiality when an adversary can obtain encryptions of selected messages.", "It appears in security proofs, encryption scheme comparisons and authorized assessments of systems that expose encryption services.", "Its relevance depends on the access granted to the adversary and the security property being evaluated." ], "standards_and_regulation": [ "ISO/IEC 18033-1, issued jointly by the International Organization for Standardization and the International Electrotechnical Commission, provides general guidance on encryption algorithms relevant to evaluating this attack model.", "NIST Special Publication 800-38A, issued by the National Institute of Standards and Technology, specifies block cipher confidentiality modes whose security assessment must consider selected plaintext exposure." ] }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q2981730: chosen-plaintext attack", "url": "https://www.wikidata.org/wiki/Q2981730", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Chosen-plaintext attack", "url": "https://en.wikipedia.org/wiki/Chosen-plaintext_attack", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "attack-identity", "name": "Attack identity", "description": "Establishes what the chosen-plaintext record represents and why the classification applies.", "rationale": "The same term can denote an adversary capability, an attack method or an executed attempt.", "layers": [ { "id": "capability-and-occurrence", "name": "Capability and occurrence", "description": "Separates hypothetical access from observed activity.", "findings": [ { "id": "recorded-attack-role", "name": "Recorded attack role", "description": "Record whether the entry describes permitted oracle access, a technique using that access or a concrete execution.", "questions": [ { "text": "Is this record a threat-model capability, a method or an observed execution?", "kind": "definition", "id": "recorded-attack-role-q01" }, { "text": "Which publication or execution evidence establishes that interpretation?", "kind": "provenance", "id": "recorded-attack-role-q02" } ] } ] }, { "id": "classification-boundaries", "name": "Classification boundaries", "description": "Identifies the capabilities that justify or exceed the CPA label.", "findings": [ { "id": "chosen-input-evidence", "name": "Chosen-input evidence", "description": "Record evidence of plaintext selection and separately identify decryption, related-key or side-channel capabilities.", "questions": [ { "text": "What demonstrates that the attacker selected the plaintext before its encryption?", "kind": "provenance", "id": "chosen-input-evidence-q01" }, { "text": "Does the claimed result depend on capabilities beyond obtaining encryptions of chosen plaintexts?", "kind": "boundary", "id": "chosen-input-evidence-q02" } ] } ] } ] }, { "id": "encryption-access", "name": "Encryption access", "description": "Captures the interface through which selected messages produce relevant ciphertexts.", "rationale": "An abstract encryption oracle may differ materially from an application's actual behavior.", "layers": [ { "id": "input-control", "name": "Input control", "description": "Determines which bytes the attacker can influence at the encryption boundary.", "findings": [ { "id": "effective-plaintext-choice", "name": "Effective plaintext choice", "description": "Record controllable regions, valid-message constraints and transformations between submitted input and encrypted plaintext.", "questions": [ { "text": "Which plaintext bytes or fields can the attacker choose?", "kind": "boundary", "id": "effective-plaintext-choice-q01" }, { "text": "How do encoding, compression, padding or fixed application fields transform that choice?", "kind": "definition", "id": "effective-plaintext-choice-q02" } ] } ] }, { "id": "oracle-and-key-context", "name": "Oracle and key context", "description": "Connects accessible encryption operations to the target.", "findings": [ { "id": "relevant-encryption-interface", "name": "Relevant encryption interface", "description": "Record how encryption is obtained, which responses are visible and how the encryption context relates to the target.", "questions": [ { "text": "Is encryption obtained through a service, induced application behavior or a public encryption key?", "kind": "definition", "id": "relevant-encryption-interface-q01" }, { "text": "What establishes the relevant key and parameter relationship between queries and target ciphertexts?", "kind": "provenance", "id": "relevant-encryption-interface-q02" }, { "text": "Which parts of each ciphertext and its accompanying metadata are observable?", "kind": "boundary", "id": "relevant-encryption-interface-q03" } ] } ] } ] }, { "id": "query-and-encryption-conditions", "name": "Query and encryption conditions", "description": "Records the sequencing, resources and encryption state required by the attack.", "rationale": "A method may cease to apply when queries cannot adapt, keys change or auxiliary-input assumptions differ.", "layers": [ { "id": "query-sequence", "name": "Query sequence", "description": "Captures dependencies and limits across encryption requests.", "findings": [ { "id": "adaptive-query-budget", "name": "Adaptive query budget", "description": "Record whether later inputs depend on previous outputs and the resources needed within the relevant access window.", "questions": [ { "text": "Which later plaintext choices depend on earlier ciphertext observations?", "kind": "definition", "id": "adaptive-query-budget-q01" }, { "text": "How many queries, plaintext bytes and sequential rounds does the method require?", "kind": "measurement", "id": "adaptive-query-budget-q02" }, { "text": "Do rate limits, session boundaries or key rotation prevent the required sequence?", "kind": "boundary", "id": "adaptive-query-budget-q03" } ] } ] }, { "id": "encryption-state", "name": "Encryption state", "description": "Captures conditions beyond the plaintext itself.", "findings": [ { "id": "randomness-nonce-and-iv-assumptions", "name": "Randomness, nonce and IV assumptions", "description": "Record generation, reuse, predictability and attacker control separately for each relevant auxiliary input.", "questions": [ { "text": "Who generates randomness, nonces and IVs, and which of these can the attacker observe or control?", "kind": "definition", "id": "randomness-nonce-and-iv-assumptions-q01" }, { "text": "Does the attack require reuse, prediction, reset or another departure from the scheme's stated conditions?", "kind": "boundary", "id": "randomness-nonce-and-iv-assumptions-q02" }, { "text": "What evidence confirms that the required condition occurs in the assessed implementation?", "kind": "provenance", "id": "randomness-nonce-and-iv-assumptions-q03" } ] } ] } ] }, { "id": "objective-and-demonstration", "name": "Objective and demonstration", "description": "Defines what counts as success and how strongly the evidence supports it.", "rationale": "Oracle access alone does not demonstrate a confidentiality failure.", "layers": [ { "id": "security-experiment", "name": "Security experiment", "description": "Makes the target claim and comparison baseline explicit.", "findings": [ { "id": "success-predicate", "name": "Success predicate", "description": "Record the security game or practical objective. An IND-CPA comparison uses equal-length candidate messages and an explicit guessing baseline. [Trevisan, section 2.3](https://theory.stanford.edu/~trevisan/books/crypto.pdf)", "questions": [ { "text": "Is success defined as distinguishing messages, inferring information, recovering plaintext or recovering a key?", "kind": "definition", "id": "success-predicate-q01" }, { "text": "Which challenge rules, permitted queries and baseline define the reported advantage?", "kind": "measurement", "id": "success-predicate-q02" }, { "text": "Does the result reveal more than message length or other leakage explicitly allowed by the claim?", "kind": "boundary", "id": "success-predicate-q03" } ] } ] }, { "id": "demonstration-quality", "name": "Demonstration quality", "description": "Connects reported results to reproducible conditions.", "findings": [ { "id": "supported-attack-outcome", "name": "Supported attack outcome", "description": "Record the tested configuration, observations, uncertainty and exact extent of the demonstrated result.", "questions": [ { "text": "Which source, transcript or reproducible experiment supports the outcome?", "kind": "provenance", "id": "supported-attack-outcome-q01" }, { "text": "What success rate, trial count, uncertainty and computational cost were measured?", "kind": "measurement", "id": "supported-attack-outcome-q02" }, { "text": "Does the evidence concern the deployed scheme, a reduced-round variant or a simplified laboratory configuration?", "kind": "boundary", "id": "supported-attack-outcome-q03" } ] } ] } ] }, { "id": "assessment-and-response", "name": "Assessment and response", "description": "Turns the recorded attack conditions into bounded evaluation and remediation decisions.", "rationale": "An agent must connect an observed weakness to an applicable action and a meaningful retest.", "layers": [ { "id": "claim-applicability", "name": "Claim applicability", "description": "Checks whether a security argument covers the assessed encryption context.", "findings": [ { "id": "assumption-match", "name": "Assumption match", "description": "Compare the precise construction and operational conditions with the assumptions of the cited security claim.", "questions": [ { "text": "Which security argument covers this construction and parameter set?", "kind": "provenance", "id": "assumption-match-q01" }, { "text": "Which required assumptions match the actual query, nonce, randomness and key-management conditions?", "kind": "boundary", "id": "assumption-match-q02" }, { "text": "What conclusion remains justified if testing finds no successful attack but no applicable proof is available?", "kind": "boundary", "id": "assumption-match-q03" } ] } ] }, { "id": "remediation-and-retest", "name": "Remediation and retest", "description": "Links proposed changes to the demonstrated failure mechanism.", "findings": [ { "id": "condition-specific-response", "name": "Condition-specific response", "description": "Record the failure condition a change addresses and the evidence required to consider that condition resolved.", "questions": [ { "text": "Which change to the encryption construction or its operation addresses the demonstrated failure condition?", "kind": "action", "id": "condition-specific-response-q01" }, { "text": "Which authorised retest preserves the relevant attacker capabilities while checking the changed behavior?", "kind": "action", "id": "condition-specific-response-q02" }, { "text": "Does the change remove the demonstrated weakness or merely increase the required query cost?", "kind": "boundary", "id": "condition-specific-response-q03" } ] } ] } ] }, { "id": "evidence-and-external-alignment", "name": "Evidence and external alignment", "description": "What the world already says about this thing, gathered so the model can be checked against it.", "rationale": "A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.", "layers": [ { "id": "reported-evidence", "name": "Reported evidence", "description": "Findings from the breadth pass, kept separate from the structural claims.", "findings": [ { "id": "evidence-confidence-notes", "name": "Check these first", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "The term describes an adversary's capabilities; their availability does not by itself imply that encryption is vulnerable.", "Formal conclusions depend on query limits, nonce control, message-length restrictions, and the precise security game.", "This account is recalled knowledge; no sources or standards were consulted." ], "questions": [ { "id": "evidence-confidence-notes-q01", "text": "Which of these check these first hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-kinds", "name": "Kinds and varieties", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Non-adaptive chosen-plaintext attack: plaintext queries are selected without using responses to earlier queries.", "Adaptive chosen-plaintext attack: later plaintext queries may depend on earlier encryption responses." ], "questions": [ { "id": "evidence-kinds-q01", "text": "Which of these kinds and varieties hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-real-world-use", "name": "Real-world use", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Defining and evaluating encryption security through indistinguishability under chosen-plaintext attack (IND-CPA).", "Studying cryptanalytic techniques such as differential cryptanalysis of block ciphers.", "Assessing systems that encrypt attacker-controlled input alongside secret data.", "Analysing public-key encryption, where anyone with the public key can encrypt chosen plaintexts." ], "questions": [ { "id": "evidence-real-world-use-q01", "text": "Which of these real-world use hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-measurements", "name": "Typical measurements", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "quantity": "Encryption query complexity", "typical_range": "Attack-dependent; no universal typical range.", "unit": "encryption queries" }, { "quantity": "Computational work", "typical_range": "Attack-dependent; assessed against available resources and the target security level.", "unit": "specified elementary operations or cipher evaluations" }, { "quantity": "Distinguishing advantage", "typical_range": "Ideally negligible as the security parameter grows; numerical normalization depends on the security-game convention.", "unit": "dimensionless" } ], "questions": [ { "id": "evidence-measurements-q01", "text": "Which of these typical measurements hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-failure-modes-and-hazards", "name": "Failure modes and hazards", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ "Deterministic encryption generally fails standard IND-CPA security because encryptions of candidate messages can be compared.", "Nonce reuse or unsuitable randomness can invalidate confidentiality guarantees, depending on the scheme.", "Predictable relationships between chosen plaintexts and ciphertexts can enable information recovery in vulnerable constructions.", "Compressing secrets together with attacker-controlled input before encryption can expose information through ciphertext length.", "Resistance to chosen-plaintext attacks alone does not establish integrity or resistance to chosen-ciphertext attacks." ], "questions": [ { "id": "evidence-failure-modes-and-hazards-q01", "text": "Which of these failure modes and hazards hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] }, { "id": "evidence-neighbours", "name": "Neighbouring kinds and how to tell them apart", "description": "Recalled without web access and unsourced; every item is a lead to verify.", "evidence": [ { "name": "Known-plaintext attack", "difference": "The adversary possesses plaintext-ciphertext pairs but does not necessarily choose the plaintexts." }, { "name": "Ciphertext-only attack", "difference": "The adversary is given ciphertexts without corresponding plaintexts or chosen-plaintext encryption access." }, { "name": "Chosen-ciphertext attack", "difference": "The adversary can obtain decryptions of selected ciphertexts, subject to restrictions in formal security games." }, { "name": "IND-CPA security", "difference": "This is a formal confidentiality property against chosen-plaintext adversaries, rather than an attack technique or a demonstrated break." }, { "name": "Differential cryptanalysis", "difference": "This is a specific analytical technique that often uses chosen plaintext pairs; chosen-plaintext attack describes adversarial access." } ], "questions": [ { "id": "evidence-neighbours-q01", "text": "Which of these neighbouring kinds and how to tell them apart hold for the sense of chosen-plaintext attack this model covers, and on what evidence?", "kind": "provenance" } ] } ] } ] } ] }, "openQuestions": [ "Which surveyed sources should anchor the distinction between chosen-plaintext access, an attack technique and a successful execution?", "Which documented cases best establish how partial plaintext control and application transformations constrain practical CPA instances?", "Which CPA formulations should be recorded explicitly, especially for nonce-based encryption, stateful schemes and public-key encryption?", "How should combined attacks be linked when chosen plaintexts enable leakage through compression, timing or another separately modelled mechanism?", "What evidence threshold should distinguish a demonstrated result from an independently reproduced result across theoretical and deployed-system cases?" ], "statistics": { "bundles": 6, "layers": 11, "findings": 16, "questions": 33 } }