Chosen-ciphertext attack