-security. In the formal definition we model chosen-plaintext attacks by giving the adversary A access to an encryption oracle, viewed as a "black box" that encrypts messages of A's choice using a key k that is unknown to A. That is, we imagine A has access to an "oracle" Enck(.); when A queries this oracle by providing it with a message m as input, the oracle returns a ciphertext cEnck (m) as the reply. (When Enc is randomized, the oracle uses fresh randomness each time it answers a query.) The adversary is allowed to interact with the encryption oracle adaptively, as many times as it likes Consider the following experiment defined for any encryption scheme Gen, Enc, Dec), adversary A, and value n for the security parameter: The CPA indistinguishability experiment PrivKP.I (n): 1. A key k is generated by running Gen(1") 2. The adversary A is given input 1" and oracle access to Enck() 3. A uniform bit b {0,1} is chosen, and then a ciphertext 4. The adversary A continues to have oracle access to Enck(.), and outputs a pair of messages mo m1 of the same length. c