Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring to the 2nd answer you may find the information that there is 50 percent chance of repetition of a duplicate block if we receive the square root of total amount of data. If some how a block is repeated how can it be cracked? How does the information gets leaked?

share|improve this question
add comment

2 Answers

The exact information leaked depends on the mode of operation that is in use. The simplest case is ECB, where a duplicate ciphertext block means that the corresponding plaintext blocks are also equal.

For the CBC mode, when two ciphertext block are equal, i.e. $C_i=C_j$, we know that there was equality before applying the block cipher. This in turn implies:$$C_{i-1}\oplus P_i=C_{j-1}\oplus P_j.$$ Equivalently, you are learning that $P_{i}\oplus P_j=C_{i-1}\oplus C_{j-1}$.

EDIT The equality comes from the fact that in CBC mode, $C_i=E_K(C_{i-1}\oplus P_i)$ where $E_K$ denotes the block cipher in use.

share|improve this answer
    
How can one prove this equality?? –  DDR Jul 17 '13 at 18:09
add comment

See minar's answer if you used ECB or CBC mode to encrypt (and CFB mode is similar to CBC mode -- if you find a colliding pair, you can deduce the relationship between two plaintext blocks).

On the other hand, one of the things that Major Major ignores is that there are modes for which a duplicate block does not leak anything. Consider counter mode (CTR); this can be defined as:

$$C_i = P_i \oplus E_k(i)$$

If we were to happen to find two blocks:

$$C_i = C_j$$

all that would tell us is:

$$P_i \oplus P_j = E_k(i) \oplus E_k(j)$$

However, since we have no information on $E_k(i) \oplus E_k(j)$ (other than that it's not zero), we can't deduce anything about $P_i, P_j$ (other than the fact that they're not the same).

Counter mode does have some data leakage if you go past the birthday boundary; however it is far more subtle than information about individual blocks.

share|improve this answer
    
That's right. However, with CTR mode, you need to be extremely careful when managing the counter. Because if you mistakenly repeat an counter value than you get a parallel message attack on a run of blocks. –  minar Jul 17 '13 at 19:37
    
@minar: that is quite true; CTR mode does have its drawbacks. My point that it does not have the specific drawback that Major Major was pointing out. –  poncho Jul 17 '13 at 20:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.