public-key encryption as an alternative in scenarios where randomized encryption has
inherent drawbacks. The resulting line of research has so far guaranteed security only for
adversarially-chosen plaintext distributions that are independent of the public key used by
the scheme. In most scenarios, however, it is typically not realistic to assume that
adversaries do not take the public key into account when attacking a scheme. We show that …