What is the difference between known-plaintext attack and chosen-plaintext attack?

Question

I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.

Can anyone explain to me how these two differ?

Answer 1

It's the difference between an active and a passive attacker:

• Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext.

• Chosen plaintext attack: The attacker can specify his own plaintext and encrypt or sign it. He can carefully craft it to learn characteristics about the algorithm. For example he can provide an empty text, a text which consists of one "a", two "aa", ... For example: if the Vigenère cipher is used, it is very easy to extract the key length and recover the key by repeating one letter.

So the second type of attack is a lot more powerful.

Answer 2

A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.

Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could use that to obtain the key to break the rest.

A chosen plaintext attack is the same thing except you get to choose the plaintext which can be useful. In this case the attacker determines what will be encrypted and then uses the result to determine the key (or perhaps other less useful information) of the encryption.

Example: A good example here is XOR encryption. If you can choose the plaintext and get to see the result, you can use those to easily determine the key being used.

You could also use a known plaintext attack with non-salted hashes. So if I choose a password and can see the resulting hash, I could search to see if there are any other similar hashes and therefore know they have the same password.

So yeah they are basically the same thing, its really just a matter of what you have to work with or what you are trying to accomplish.

Answer 3

As others have pointed out, there are some ciphers that can be broken if all you have is a known plaintext and the ciphertext. In general, because of this, those ciphers are considered very vulnerable and are not used anywhere. Or I should say, where they are used, the keys are generated (pseudo-) randomly and only used once.

However, if the attacker can choose the plaintext, more commonly used ciphers become insecure. In particular Public-Key cryptography has a glaring weakness in this regard, because signing a plaintext is exactly the same operation as decrypting a ciphertext. If an attacker can get a target to sign a message anyone encrypted with the target's public key (i.e. sent to the target) and retrieve the signature, then the attacker has recovered the plaintext of the message. This is one reason digital signature schemes are set up to only sign a hash of the message, not the entire message itself.

In more sophisticated attacks, using large numbers of chosen plaintexts can reveal patterns in the ciphertext that in turn reveal some if not all of the bits of the key. Usually, though, the number of chosen plaintexts is huge: millions to trillions or more.

A cipher that is vulnerable to known plaintext attacks is of course vulnerable to chosen plaintext attacks, but more importantly can be broken without any access to the encryption device. Intercepting the communications alone compromises the cipher. On the other hand, chosen plaintext attacks do require access to the encryption device, and thus are considered secure as long as the encryption device itself is secure.