# Is less security required for a short stream cipher than for the AES enciphering of very long messages? [closed]

Criticisms of a cipher system such as 'the ciphertext from one message must be indistinguishable from the ciphertext of a second message" surely only apply when there are very large amounts of ciphertext available. If a stream cipher involves a limited number of messages (say 10) of limited length (say 1000 characters each) enciphered with differently keyed streams, then surely there is not sufficient information available for breaking the cipher?

The focus of modern cryptology on computer systems that pump out billions of characters is in fact just on a partial domain of all cryptology.

-

## closed as unclear what you're asking by CodesInChaos, poncho, Reid, Maeher, hunterApr 22 '14 at 16:13

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

Why would you use a system that doesn't fulfill strong security notions when they are easily available and still very fast? Figuring out if certain weaknesses apply to your use case is hard and error prone. Pretty much the only exception are hand ciphers where you need to be able to encrypt/decrypt a message without a computer. –  CodesInChaos Apr 22 '14 at 11:02
What exactly is your question? –  CodesInChaos Apr 22 '14 at 11:04
My question is whether the tenets expounded by the proponents of modern cryptological systems are relevant in the whole domain? Clearly I think they are not! As for your 'strong security notions', those of today are quite likely to be different to those of yesterday. If I invent my own crypto scheme, it may not in theory be as strong as AES but on the other hand I will know it is free of backdoors and perhaps other weaknesses that the community just doesn't know about today. –  user2256790 Apr 22 '14 at 12:28
"If I invent my own crypto scheme ... I will know it is free of ... other weakness that the community just doesn't know about today". Actually, you don't know that; in fact, any scheme you can come up with is likely to be less secure than AES. –  poncho Apr 22 '14 at 13:30
You might know it will be free of intentional backdoors. But you're trading that off for the overwhelming probability of multiple unintentional trivially-exploited catastrophic vulnerabilities. –  Stephen Touset Apr 22 '14 at 18:08

A viable answer to the question, as posed in the title, is: No

If a stream cipher involves a limited number of messages (say 10) of limited length (say 1000 characters each) enciphered with differently keyed streams, then surely there is not sufficient information available for breaking the cipher?

As you would expect, this depends completely on the scheme. If the cipher is very weak then no, even this might not be sufficient (eg the age-old Caesar/rotation cipher might be broken within 10 character messages). On the other hand, if a scheme is still secure even when $2^{56}$ characters have been sent, then it will certainly be secure if we limit to just $10^4\approx 2^{13}$ characters!

We try to prove schemes secure within a more difficult environment from any it would actually face, on the grounds that if still secure there it will definitely be secure in the real-life scenario.

However, one must be very careful when trusting the security of a scheme due to a security proof to ensure that the proof has been conducted in such a way that it does actually imply security in your actual use case. For example, if suppose somebody proves that a scheme is secure in the IND-CPA game even when the attacker is given many gigabytes worth of plaintext-ciphertext data. Then, certainly an attacker than can only learn about your scheme through submitting a few kilobytes worth of chosen plaintext cannot break the scheme. However, if the attacker is also allowed to submit chosen ciphertexts for decryption (IND-CCA) then we have no guarantee of security.

You appear to be asking for historical/'non-computer' justification behind the attack scenarios, so here is a wikipedia page about British CPA attacks during WW2 and whilst I think my original choice of reference is a passage in Katz-Lindell, here is a web page on the subject, the validity of which I cannot confirm.

-
I am glad you mention chosen plaintext attack because this illustrates well my criticism. Such an attack is a feature of computer systems. In an exchange of secret messages between two people, as for example in a WW2 Enigma net, it is unthinkable that one will provide a 'chosen plaintext' to an attacker. This illustrates my contention that modern cryptology is focussed on conditions that prevail in just part of the domain -- and probably are irrelevant in other parts. –  user2256790 Apr 22 '14 at 12:26
You are incorrect there: it is a well known and age-old techinque. I'll try and find a reference, but the US gave false information to Japanese spies, then listened to the encrypted messages being sent. Similarly, Known-plaintext-attacks were used in for most WW2 era code-breaks. –  figlesquidge Apr 22 '14 at 12:28
I second figlesquidge: choosen plaintext is a reasonable practical assumption, including in WW1. If one puts a letter in an embassy's mailbox with a well-crafted intro on the tune of: I intercepted this:, there is a reasonable chance that it will be sent encrypted for analysis. –  fgrieu Apr 22 '14 at 12:47
update: I can't find the reference I was looking for, but here is a similar one. I think my original one is recounted in Katz-Lindell, and here is a web page on the subject, validity of which I do not know. –  figlesquidge Apr 22 '14 at 12:53
Yes thanks for that - a neat example. –  user2256790 Apr 23 '14 at 7:51