Tagging of questions about IND-CPA and IND-CCA security

Question

In the past, I (and presumably others) used to tag questions about ciphertext indistinguishability under various attack scenarios with the tags for the relevant attacks (e.g. chosen-plaintext-attack for IND-CPA, chosen-ciphertext-attack for IND-CCA or IND-CCA2, etc.).

However, recently, the more specific tags ind-cpa and ind-cca have been created. At the moment, these are only used on a handful of questions, and are mostly redundant to the older tags, but presumably their existence will lead to people using them. I do feel that these are sort of "natural" tags, but the redundancy with the older, more general tags concerns me a bit, so I'd like to ask for the community's opinion on what to do with these tags.

Specifically, here are a few options I can think of:

1. Do nothing, just let these tags live and grow as people use them. This is, of course, the default option. Alas, this choice would likely mean that most future questions on, say, IND-CPA security would be redundantly tagged with both ind-cpa and chosen-plaintext-attack, except for a random few where the asker either missed one of the tags or bumped against the five tag limit.

2. Merge the new tags into the older ones, making ind-cpa a synonym for chosen-plaintext-attack and ind-cca a synonym for chosen-ciphertext-attack. (I already suggested the former synonym, but I don't have enough answer score to do the same for the latter.) This would eliminate the redundancy, but only at the cost of some expressive power.

3. Keep both sets of tags and try to make them less redundant, e.g. by using only the "ind-*" tags for questions about formal ciphertext indistinguishability, and reserving the "*-attack" tags for other questions about such attacks (e.g. "how to decrypt this message using a chosen plain/ciphertext attack?"). This would mean going through a bunch of old questions (12 + 7, at the moment) and retagging them where necessary. If we go this route, we should also add clear tag wiki summaries for all those tags describing how and when they're to be used, and keep an eye open for mistagged questions in the future.

Of course, there might also be other options I couldn't think of.

Personally, I'd prefer either option 2 or 3 over the default of just leaving the tags like they are. I have no strong preference between them, though, so I'd like to ask what others think:

Should we have tags for ind-cpa and ind-cca separately from chosen-plaintext-attack and chosen-ciphertext-attack?

Answer 1

I don't have a strong opinion, but here's my sense:

Use ind-cpa where the question asks about IND-CPA, or about semantic security, or other notions of provable security that are equivalent to IND-CPA.

Use chosen-plaintext-attack where the question asks about a particular chosen-plaintext attack, e.g., differential cryptanalysis or something like that.

Examples:

• What is the difference between known-plaintext attack and chosen-plaintext attack? - tag it with chosen-plaintext-attack, not ind-cpa.

• Message space in security definitions - use ind-cpa, not chosen-plaintext-attack (the question specifically asks about an aspect of the definition of IND-CPA).

• Figuring out key in hill cipher (chosen-plaintext attack) - tag it with chosen-plaintext-attack, not ind-cpa (this question is not about IND-CPA; it is about chosen-plaintext attacks to recover the key, on a cipher that obviously fails to be IND-CPA).

• How to construct a variable length IND-CPA cipher from a fixed length one? - use ind-cpa, not chosen-plaintext-attack (the question specifically asks IND-CPA security).

Do something similar for chosen-ciphertext-attack vs ind-cca.

I do think we should make semantic-security a synonym for ind-cpa.