Why is pseudorandom OTP (P-OTP) IND-CPA insecure My lecture notes state that P-OTP is IND-COA but not IND-CPA insecure. I understand IND-COA secure, assuming PRG is secure, as that is the whole point of a OTP, but why is it IND-CPA insecure? Surely, if the PRG is assumed to be secure, then the resulting ciphertext would be random, so whatever plaintext you feed into the oracle will reveal no information.

I ask this because PRF+OTP is IND-CPA secure and cannot figure out the difference.

$Enc_k(m)=m\oplus PRG(k)$

$Dec_k(c)=c\oplus PRG(k)$

and the IND-CPA adversary game:


Pick two messages $m_0$ and $m_1$ arbitrarily.
Send them to the challenger who chooses $b\in\{0,1\}$ uniformly at random and returns you $c_1=Enc_k(m_1)$.
Output your guess for $b$ named $b'$. You "win" iff $b=b'$.


Edit: screenshots of the relevant slides
The game you stated is not the IND-CPA game, it is the IND-EAV game, where the adversary is given only the challenge ciphertext and is asked to guess the message being encrypted. In the IND-CPA game,the adversary is given access to an encryption oracle that can encrypt arbitrary messages of his choice.

The main reason why P-OTP can not be CPA-secure is because it is deterministic, that is, if you encrypt the same plaintext twice you'll get the same ciphertext. In general, any scheme with this property can not be CPA-secure, can you figure out why?

On the other hand, PRF+OTP is not deterministic: it refreshes each encryption with a random value $r$. This key difference makes the scheme CPA-secure, the proof can be found in any basic book like Katz' Modern Cryptography (Thm 3.31 in the 2nd edition), but the basic idea is that if the value $r$ is not repeated in the oracle's queries, then the attacker get no information about the message being encrypted (so you have perfect secrecy in this case, just like in the OTP), and the probability that this does not occurre is small enough.