attacker only has access to a collection of ciphertexts; more likely than known plaintext, but also the most difficult.