Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys you'd find in the wild.

Say you have one hundred ciphertexts which you know are the result of encrypting exactly the same plaintext with one hundred different public keys. Is there any vulnerability here in terms of figuring out what the plaintext is or what the private keys are, either using an RSA-based system or an elliptic curve-based system?

If there is, what would some valid approaches be to preventing the attack? I'm thinking along the lines of the first four bytes being a seed to a PRNG which modify the remaining bytes in some way so that the plaintexts end up being quite different. I suppose something like OAEP should be enough?

share|improve this question

RSA is vulnerable to this attack if an insecure padding scheme is used. Still unsure about elliptic curve cryptography.

share|improve this answer
The "ECC" part is unanswerable without you specifying how precisely you use ECC. Usually we don't encrypt any data with ECC at all, we use it to generate a shared key which is then used to encrypt data. – CodesInChaos Apr 27 '14 at 13:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.