Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does the same encryption algorithm given the same plaintext always produces the same ciphertext?

Does this cause any security flaws?

share|improve this question
That depends on the mode. Most secure modes use an IV to prevent both of them. – CodesInChaos Jun 11 '12 at 10:01

It very much depends on the encryption scheme you are using. In a deterministic encryption scheme, the same plaintext is always encrypted to the same ciphertext (when using the same key of course). This indeed causes a security problem for all deterministic schemes. I.e. no deterministic scheme can be IND-CPA secure.

If you take a look at the IND-CPA game, you can see why: The adversary $\mathcal{A}$ may simply choose two random messages $m_0,m_1$ and submit them to the challenger. After receiving the ciphertext $c$ he asks for an encryption of $m_0$ and receives ciphertext $c'$. Now as the scheme is deterministic, it follows that $c=c'$ if and only if $c$ is an encryption of $m_0$, therefore if $c=c'$ $\mathcal{A}$ outputs $0$, otherwise $1$.

Therefore, to achieve IND-CPA security we need probabilistic encryption. In a probabilistic encryption scheme, the encryption algorithm uses additional randomness to produce the ciphertext. See for example ElGamal encryption, where the ciphertext consists of two parts, one of which is a random group element. Also all secure modes of operations for block-ciphers introduce randomness in the form of nonces or initialization vectors.

An important thing to note about probabilistic encryption is that, because decryption must be deterministic, and a single plaintext corresponds to a larger number of ciphertexts, the ciphertext will always be longer than the plaintext.

share|improve this answer

Yes and yes. And that's why it's common to introduce additional information, e.g. the Initialization Vector in CBC mode.

share|improve this answer

"Does generating the same ciphertext twice (when given the same plaintext) cause any security flaws?"

Yes, generating the same ciphertext twice opens up a system to the possibility of replay attacks.

"Does the same encryption algorithm given the same plaintext always produces the same ciphertext?"

In general, no. Many encryption algorithms, in principle, could give the same ciphertext if they were ever given the same inputs twice. But properly-designed encryption systems try very hard not to give the underlying encryption algorithm exactly the same inputs twice. Modern complete encryption systems pull bytes from a random number generator and use them as some kind of nonce, perhaps an initialization vector (IV) or padding or something else. They do that specifically to make every ciphertext unique, to avoid replay attacks, even when given exactly the same plaintext twice. Even password hashes use a random salt, so that an attacker who reads the /etc/passwd password file (which stores the salt and the hash in plaintext) can't tell when two of those accounts use exactly the same password.

The same encryption algorithm, when given exactly the same inputs -- i.e., the random number generator is broken and gives us the same series of bytes a second time, and we use the same encryption key and the same plaintext -- will always produce the same ciphertext.

Mathematics StackExchange: Is every encryption a bijective function?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.