I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how these two differ?
migrated from security.stackexchange.com Jun 10 '12 at 18:58
This question came from our site for information security professionals.
Known Plaintext Attack
You sniff a lot of thhing about your victim but every of them is ciphertext so you don't know anything about them. And you learn o plan text of your victim by any means; but you don't know the plaintext is which ciphertext's. So you must solve this problem.
Choosen Plaintext Attack
You know a plaintext and you know the plaintext is which cipertext's. And you try to solve the algorithm of encryption system.
It's the difference between an active and a passive attacker:
So the second type of attack is a lot more powerful.
As others have pointed out, there are some ciphers that can be broken if all you have is a known plaintext and the ciphertext. In general, because of this, those ciphers are considered very vulnerable and are not used anywhere. Or I should say, where they are used, the keys are generated (pseudo-) randomly and only used once.
However, if the attacker can choose the plaintext, more commonly used ciphers become insecure. In particular Public-Key cryptography has a glaring weakness in this regard, because signing a plaintext is exactly the same operation as decrypting a ciphertext. If an attacker can get a target to sign a message anyone encrypted with the target's public key (i.e. sent to the target) and retrieve the signature, then the attacker has recovered the plaintext of the message. This is one reason digital signature schemes are set up to only sign a hash of the message, not the entire message itself.
In more sophisticated attacks, using large numbers of chosen plaintexts can reveal patterns in the ciphertext that in turn reveal some if not all of the bits of the key. Usually, though, the number of chosen plaintexts is huge: millions to trillions or more.
A cipher that is vulnerable to known plaintext attacks is of course vulnerable to chosen plaintext attacks, but more importantly can be broken without any access to the encryption device. Intercepting the communications alone compromises the cipher. On the other hand, chosen plaintext attacks do require access to the encryption device, and thus are considered secure as long as the encryption device itself is secure.
A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.
Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could use that to obtain the key to break the rest.
A chosen plaintext attack is the same thing except you get to choose the plaintext which can be useful. In this case the attacker determines what will be encrypted and then uses the result to determine the key (or perhaps other less useful information) of the encryption.
Example: A good example here is XOR encryption. If you can choose the plaintext and get to see the result, you can use those to easily determine the key being used.
You could also use a known plaintext attack with non-salted hashes. So if I choose a password and can see the resulting hash, I could search to see if there are any other similar hashes and therefore know they have the same password.
So yeah they are basically the same thing, its really just a matter of what you have to work with or what you are trying to accomplish.