3.2.1 The Basic Definition of Security (EAV-Security)

• 
  EAV is a passive adversary model in cryptography that can only eavesdrop on transmitted messages, but cannot modify them or influence the exchange process.

Формула Эйлера:

$$

e^{i\pi} + 1 = 0

$$

Формула Эйлера:

$$e^{i\pi} + 1 = 0$$

In the context of EAV cryptography, security means that the ciphertext should not reveal any information about the plaintext, even if an attacker is watching the transmission.

EAV (Eavesdropping) in Cryptography

EAV is a passive adversary model in cryptography that can only eavesdrop on transmitted messages, but cannot modify them or influence the exchange process.

In the context of cryptography, EAV security means that the ciphertext should not disclose any information about the plaintext, even if an attacker is watching the transmission.

1. The formal definition of EAV security

Let:

• ( \Pi = (\text{Gen}, \text{Enc}, \text{Dec}) ) — encryption scheme.
  


• ( \mathcal{A}) — an adversary trying to get information about the message.
  


• (m_0, m_1) — two messages of the same length.
  

The EAV Experiment (Indistinguishability under EAV attack)

1. Key generation: (k\leftarrow\text{Gen}(1^n))
   


2. The opponent selects (m_0, m_1) and sends them to the cryptographer.


3. The cryptographer selects (b\in{0,1}) randomly and returns (c\leftarrow\text{Enc}_k(m_b)).
   


4. The opponent tries to guess (b') based on (c).
   

The (\Pi) EAV scheme is safe if:


[

\Pr[b' = b] \leq \frac{1}{2} + \text{negl}(n)

]


where ( \text{negl}(n) ) is a negligible function.

Why is ECB not EAV-safe?


Repeated blocks give the same ciphertext → information leakage.

✅ Solution: AES in CBC or CTR mode

These modes use IV (Initialization Vector), which makes encryption non-deterministic.

Conclusion

• 
  EAV security is the minimum requirement for cipher strength.
  


• 
  OTP is ideal theoretically, but impractical.
  


• 
  Practical schemes (AES-GCM, ChaCha20-Poly1305) provide EAV security and resistance to stronger attacks (CPA, CCA).

Here, we keep the experiment PrivKeav

A almost exactly the same (except

for some technical di erences discussed below), but introduce two important

modi cations in the de nition itself:

1. We now consider only adversaries running in polynomial time, whereas
   De nition 2.6 considered even adversaries with unbounded running time.


2. Wenowconcede that the adversary might determine the encrypted mes
   sage with probability negligibly better than 12