KPA-Security definition

• Per Katz and Lindell 3rd ed. section 7.2. "In a known-plaintext attack, the attacker is given pairs of inputs/outputs $\{(x_i,F_k(x_i))\}$ (for an unknown key $k$), with the $\{x_i\}$ outside the attackers control." KPA is the usual attack model for linear cryptanalysis, but is insufficient for differential cryptanalysis where we need each input to match up with another specific fixed input. Take any simple linear analysis of a block cipher and it should only use the KPA property.
• Per Katz and Lindell 3rd ed. section 1.4.1: "none of them [the threat models] is inherently better than any other; the right one to use depends on the environment in which an encryption scheme is deployed"
• Yes, one could envision a block cipher that is secure against linear cryptanalysis, but insecure against differential cryptanalysis. If we further assume that insufficient difference data can be acquired simply by generating inputs in an uncontrolled way, the cipher would be KPA secure, but not CPA secure. If deployed somehow that means that adversaries cannot influence the choice of input, the cipher would presumably not be at risk. Most cryptographers would still prefer a cipher that is CPA (or indeed CPA plus CCA) secure.

Note that the above discussion is restricted to symmetric cryptography. With public key encryption, we have to assume CPA at a minimum as the public encryption method automatically allows the adversary a CPA capability.