# What is the difference between known-plaintext attack and chosen-plaintext attack?

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.

Can anyone explain to me how these two differ?

-
Welcome to Cryptography Stack Exchange. Your question was migrated here because of being related to the more theoretic parts of cryptography, which are on-topic here (and not so much on Security Stack Exchange). Please register your account here, too, to be able to comment and accept an answer. –  Paŭlo Ebermann Jun 10 '12 at 20:31

## migrated from security.stackexchange.comJun 10 '12 at 18:58

This question came from our site for Information security professionals.

It's the difference between an active and a passive attacker:

• Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext.

• Chosen plaintext attack: The attacker can specify his own plaintext and encrypt or sign it. He can carefully craft it to learn characteristics about the algorithm. For example he can provide an empty text, a text which consists of one "a", two "aa", ... For example: if the Vigenère cipher is used, it is very easy to extract the key length and recover the key by repeating one letter.

So the second type of attack is a lot more powerful.

-
And just for completeness, note that the "known plaintext" is a special case of "chosen plaintext". –  B-Con Jun 10 '12 at 23:39
@Hendrik Can known/chosen plaintext attack be carried out on Hash functions? –  Pacerier Jul 3 '12 at 16:27

A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.

Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could use that to obtain the key to break the rest.

A chosen plaintext attack is the same thing except you get to choose the plaintext which can be useful. In this case the attacker determines what will be encrypted and then uses the result to determine the key (or perhaps other less useful information) of the encryption.

Example: A good example here is XOR encryption. If you can choose the plaintext and get to see the result, you can use those to easily determine the key being used.

You could also use a known plaintext attack with non-salted hashes. So if I choose a password and can see the resulting hash, I could search to see if there are any other similar hashes and therefore know they have the same password.

So yeah they are basically the same thing, its really just a matter of what you have to work with or what you are trying to accomplish.

-
+1, but xor is the standard example for known-plaintext based attacks: cyphertext = key xor plaintext implies key = plaintext xor cyphertext. –  Hendrik Brummermann Jun 10 '12 at 22:04
If you know plaintext $X$ and its encrypted form $Y$ where $Y = X \oplus Z$, $Z$ being the key, then the key is recoverable as $X \oplus Y$, and whether you get to choose $X$ (as in a chosen plaintext attack) or just have some arbitrary $X$ that you chanced upon (as in a known plaintext attack) is completely irrelevant. You could ease your life slightly by choosing a plaintext $X = 0$ to get the key as $Y$ directly (as opposed to doing a $X\oplus Y$ as in a known plaintext attack), but I think that is not much of an advantage. –  Dilip Sarwate Jun 10 '12 at 22:08