What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.

Can anyone explain to me how these two differ?

-
Welcome to Cryptography Stack Exchange. Your question was migrated here because of being related to the more theoretic parts of cryptography, which are on-topic here (and not so much on Security Stack Exchange). Please register your account here, too, to be able to comment and accept an answer. – Paŭlo Ebermann Jun 10 '12 at 20:31

migrated from security.stackexchange.comJun 10 '12 at 18:58

It's the difference between an active and a passive attacker:

• Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext.

• Chosen plaintext attack: The attacker can specify his own plaintext and encrypt or sign it. He can carefully craft it to learn characteristics about the algorithm. For example he can provide an empty text, a text which consists of one "a", two "aa", ... For example: if the Vigenère cipher is used, it is very easy to extract the key length and recover the key by repeating one letter.

So the second type of attack is a lot more powerful.

-
 And just for completeness, note that the "known plaintext" is a special case of "chosen plaintext". – B-Con Jun 10 '12 at 23:39 @Hendrik Can known/chosen plaintext attack be carried out on Hash functions? – Pacerier Jul 3 '12 at 16:27

As others have pointed out, there are some ciphers that can be broken if all you have is a known plaintext and the ciphertext. In general, because of this, those ciphers are considered very vulnerable and are not used anywhere. Or I should say, where they are used, the keys are generated (pseudo-) randomly and only used once.

However, if the attacker can choose the plaintext, more commonly used ciphers become insecure. In particular Public-Key cryptography has a glaring weakness in this regard, because signing a plaintext is exactly the same operation as decrypting a ciphertext. If an attacker can get a target to sign a message anyone encrypted with the target's public key (i.e. sent to the target) and retrieve the signature, then the attacker has recovered the plaintext of the message. This is one reason digital signature schemes are set up to only sign a hash of the message, not the entire message itself.

In more sophisticated attacks, using large numbers of chosen plaintexts can reveal patterns in the ciphertext that in turn reveal some if not all of the bits of the key. Usually, though, the number of chosen plaintexts is huge: millions to trillions or more.

A cipher that is vulnerable to known plaintext attacks is of course vulnerable to chosen plaintext attacks, but more importantly can be broken without any access to the encryption device. Intercepting the communications alone compromises the cipher. On the other hand, chosen plaintext attacks do require access to the encryption device, and thus are considered secure as long as the encryption device itself is secure.

-
 “Signing a plaintext is exactly the same operation as decrypting a ciphertext”: only if you do it wrong. For example, RSA-OAEP is an asymmetric encryption algorithm, RSA-PSS is an asymmetric signature algorithm, raw RSA is not a cryptographic algorithm but a building block for one. (The padding scheme isn't the only thing that distinguishes RSA-based signature and encryption algorithm; Schneier recommends using different public exponents, and common wisdom avoids using the same key for both purposes.) – Gilles Jun 13 '12 at 14:03

A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.

Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could use that to obtain the key to break the rest.

A chosen plaintext attack is the same thing except you get to choose the plaintext which can be useful. In this case the attacker determines what will be encrypted and then uses the result to determine the key (or perhaps other less useful information) of the encryption.

Example: A good example here is XOR encryption. If you can choose the plaintext and get to see the result, you can use those to easily determine the key being used.

You could also use a known plaintext attack with non-salted hashes. So if I choose a password and can see the resulting hash, I could search to see if there are any other similar hashes and therefore know they have the same password.

So yeah they are basically the same thing, its really just a matter of what you have to work with or what you are trying to accomplish.

-
 +1, but xor is the standard example for known-plaintext based attacks: cyphertext = key xor plaintext implies key = plaintext xor cyphertext. – Hendrik Brummermann♦ Jun 10 '12 at 22:04 If you know plaintext $X$ and its encrypted form $Y$ where $Y = X \oplus Z$, $Z$ being the key, then the key is recoverable as $X \oplus Y$, and whether you get to choose $X$ (as in a chosen plaintext attack) or just have some arbitrary $X$ that you chanced upon (as in a known plaintext attack) is completely irrelevant. You could ease your life slightly by choosing a plaintext $X = 0$ to get the key as $Y$ directly (as opposed to doing a $X\oplus Y$ as in a known plaintext attack), but I think that is not much of an advantage. – Dilip Sarwate Jun 10 '12 at 22:08