I'm referring to the thing the attacker computes right before that sentence. The attacker has computed: C_1 ^ C_2 = P_1 ^ P_2 The right hand side is known; it

I'm referring to the thing the attacker computes right before that sentence. The attacker has computed: C_1 ^ C_2 = P_1 ^ P_2 The right hand side is known; it's the two ciphertexts. The right hand side is hence also known, but neither P1 nor P2 is known. Except, of course, if you have a plaintext that has a lot of Z's in it, because then I know one of P1/P2, and I can cancel out the Z's :) Is that what you mean by "indirectly"?