Ciphertext.

Ciphertext is the encrypted form of plaintext produced by a cipher under a specific key, mode, and (when applicable) nonce or IV. A well-designed cipher makes ciphertext computationally indistinguishable from random data without the key — a property formalised as IND-CPA and, for authenticated schemes, IND-CCA security.

Ciphertext alone does not guarantee security; how it is generated and handled matters. It must be paired with proper key management, authenticated encryption (AES-GCM, ChaCha20-Poly1305) to detect tampering, and a unique nonce per message — reusing a GCM nonce catastrophically leaks the authentication key. History is full of attacks that recovered plaintext without ever breaking the underlying cipher, by abusing how ciphertext was processed: padding-oracle attacks on CBC, BEAST (CVE-2011-3389) against TLS 1.0, Lucky Thirteen timing leaks, and POODLE (CVE-2014-3566, disclosed October 2014), which forced a downgrade to SSL 3.0's malleable CBC padding to decrypt session cookies one byte at a time.

The defensive lessons are consistent: prefer AEAD modes, encrypt-then-MAC rather than MAC-then-encrypt, use constant-time verification, and reject any ciphertext whose authentication tag fails before doing anything else with it.

flowchart LR
  P[Plaintext] --> E[Encrypt<br/>cipher + key + nonce/IV]
  E --> C[Ciphertext + auth tag]
  C -->|store / transmit| V{Verify tag}
  V -->|Tag valid| D[Decrypt → plaintext]
  V -->|Tag invalid| R[Reject — do not process]