# Tag Info

## Hot answers tagged ciphertext-only-attack

22

Let's assume that the plaintexts consist only of spaces and ASCII letters. Given the hint, that seems like a reasonable assumption to start with, even if it might turn out to be only mostly correct. Now, take one of the ciphertexts and XOR it with each of the others. Of course, the XOR operation cancels out the keystream, so you end up with the plaintext ...

8

Historically, there did exist a benefit to using a language that the adversary was not familiar with. The name for this is code talkers, and the most famous ones (at least in the USA) are the Navajo code talkers of World War II. The idea was to defeat attacks that relied on statistics about the language used in the plaintext. In modern cryptography, ...

6

I was/am assuming that for public key encryption, COA means "other than the public key, ciphertext only". Otherwise, any secure symmetric cipher with the key published becomes a "COA resistant" PKE scheme. With that in mind, access to an encryption oracle cannot possibly help an attacker, since the attacker can already encrypt any plaintext using the ...

6

If I understand right, your operation effectively is $$\forall i: c_i = p_i \oplus k_0 \oplus k_1 \oplus k_2 \oplus \dots \oplus k_n,$$ whith $c_i$ the ciphertext bits, $p_i$ the plaintext bits, and $k_j$ the key bits. As $\oplus$ (this is XOR) is associative, this is equivalent to $$k^* := k_0 \oplus k_1 \oplus k_2 \oplus \dots \oplus k_n,$$ \forall ...

5

Unless you are badly (and I mean truly badly) misrepresenting the idea, it is one of the worse ideas I've seen in crypto in quite some time. The first bit is effectively exclusive or'ed with the parity of the key; the ciphertext bit will be either the plaintext bit (if the key has an even number of '1' bits) or the complement of the first plaintext bit (if ...

5

Well, from your previous questions, I'm assuming that your writing a utility to brute-force decrypt a password protected file (encrypted with a certain encryption utility), and you're looking for a way to determine whether your trial decryption is plausible. Normally, when an attacker attempts to decrypt something, he has some idea about what it is (why ...

4

The usual assumption is that the attacker knows a full plaintext block; that's what the EFF DES-cracking machine uses. That machine knows exactly 8 consecutive plaintext bytes and the corresponding ciphertext block; it stops when it finds a matching key. Since there are 256 possible DES keys, and 264 possible 8-byte blocks, chances are high that there is ...

4

Since for any fixed key the encryption algorithm is a bijection from the set of $n$-bit strings onto itself, the set of all possible ciphertexts is regardless of the key and algorithm always the set of all $n$-bit strings and does not provide any information.

4

If you don't know the system, you just check one after the other: frequency analysis of bigrams detects Ceasar and Playfair. Try Caesar first then Playfair. Auto correlation method for Vigenere (for each x: count the number of occurances, where letter at position i and i+x are equal. For the correct codeword length, it will spike) If you have a Hill cipher,...

4

If you're referring to a classical cipher, it might complicate frequency analysis and other such techniques. For a modern cipher, it makes no difference. Modern ciphers operate on arbitrary patterns of information. Ideally, the ciphertext of a modern cipher should have no relation of any kind to the associated plaintext, other then the key.

4

If you have a stream, $s$, of $n$ bits that is computationally indistinguishable from random, then any truncation of that $n$ bit string must also be indistinguishable from random. The proof of this is straightforward. If $s$ was computationally indistinguishable from random, but some truncation of $s$ was not then we could distinguish the larger sequence ...

4

There are several algorithms available which can attack a playfair cipher. Hill climbing might be one option. Basically it starts with a random key (assuming it's the best one) and decrypts the cipher. The resulting clear text is scored using a fitness function. Then small changes are applied to the key and if the resulting clear text of the modified key ...

3

It's not elegant, but the brute force method is to write a program that creates a table of 25x25 digraphs (assuming i=j), yielding 625 rows. I'd also add a column that lists the relative frequency of each digraph (given enough ciphertext you can use that to identify frequent substitutions, as you already have done). You start off with 625! possible ...

3

I'm not exactly certain what answer you're looking for; I tried to cover all the obvious bases. Actually, with RSA, we generally assume that the attacker knows the public key (the modulus $n$ and the public exponent $e$); with that, he can encrypt as much plaintext as he cares to (by selecting a value $M$ and computing $M^e \bmod n$). So, in that sense, the ...

3

The actual "encryption" is done on this line: mysecretmessage[i] ^= ((mysecretvalue>>(8*(i%4)))&255); Clearly, this line XORs every byte (or at least, every element; but it makes sense to assume that this is indeed a byte array) of mysecretmessage with some value derived from mysecretvalue and the byte counter i. So what does the expression ((...

3

Simplified DES is a toy Feistel cipher with 16-bit 8-bit block and 10-bit key, and only two rounds, intended for educational purposes. Here is a preview of the original paper, and an implementation; another; yet another. If one knows one block of ciphertext, but nothing about the plaintext and key, the plaintext can not be guessed entirely: each of the $2^{... 2 In an effort to guess what the poster is saying, I tried to develop a "secure-as-possible" (but not really secure at all) cipher using only minor modifications of the above:$Key = {k_0, k_1 ... k_m}Plaintext = {p_0, p_1 ... p_n}Ciphertext = {c_0, c_1 ... c_n}\forall i: i \le m \rightarrow c_i = p_i \oplus k_i$The first$m$bits of ciphertext ... 2 The answer is yes, primarily because it has been done. Linear B, Akkadian, Sumerian, and hieroglyphics all had no persons with knowledge of them for centuries, and yet we can translate them today. 2 A core assumption of natural languages is that conceptual frequency and the grammar to construct and articulate concepts is not evenly and randomly distributed; so pattern discovery can occur. However, two problems can quickly arise: If the language sample (or collection of samples) is too small, the patterns may not be distinct and consistent. Cretan ... 2 I had a look at classic transpositioning and substitution methods which lead me to encryptions like Vigenére, Autokey, Beaufort and so on. However, those are designed to work with non-numeric alphabets as far as my understanding goes. While most classical ciphers are applied to the usual alphabet (without different cases), they are not limited to that. It'... 2 When you have a RSA key pair, it means that you know the private key (otherwise this is not "your" key pair). The private key format, normally, contains the two factors$p$and$q$(at least so it goes with PKCS#1). Even if all you have are the modulus$n$, the public exponent$e$and the private exponent$d$, the factorization of$n$can still be worked out ... 2 Around and about one hundred years ago, your idea would surely have made sense… but nowadays, modern technology and evolved cryptanalytic techniques are too smart to have a real problem coping with something like that. (Also see my related answer to “Why was the Navajo code not broken by the Japanese in WWII?”) Even when we completely ignore Kerckhoffs’ ... 2 No, that's not really possible without blatant flaws of the implementation. Modern modes of operation of ciphers are resistent to attacks even if you know many pairs of plaintext and ciphertext - and the IV is public knowledge. Knowing it is the normal case. You also didn't mention what operation mode was used. Well, of course you could brute force the key, ... 2 Insecure, since an attacker A is not only given the ciphertext$c$, but also the key$r$with which the message was encrypted. Thus, it can easily decrypt the ciphertext. Correct, there is no encryption here. I would say that it's not IND-CPA secure, since it's deterministic. Is that true? And how can I prove/determine whether it's IND-COA secure?... 2 This scheme does not have indistinguishable encryptions since the encryption function does not use the key, so an adversary can run the decryption function in the same way as the intended recipient. This scheme is not CPA-secure because it is deterministic (so it does not even have indistinguishable encryptions for multiple messages). To show that it has ... 1 Looks rather OK to me. As for the first question, XOR with a value won't introduce any duplicate values and now$F$is a PRP the first part of the answer should be correct. It's clearly deterministic, so no IND-COA or CPA security. As for the second question$F_k(r ||m)$seems to me identical to a single block encrypt with CTR mode. However, for CTR ... 1 You ask many questions and it is not clear to me exactly what you would like to have answered. In particular, what do you mean by: My problem is that I couldn't find out, whether$G(k)_{0...n−1}$can be treated exactly like$G_k$. What is$G_k$supposed to mean here? The full output of$G(k)$? What is your definition of "treated exactly like"? In any ... 1 If your fully homomorphic scheme is asymmetric and deterministic, then, it is already broken. One could just encrypt the value one,$c_1 = E(pk, 1)$, then, adds$c_1$to itself until$c_1 + c_1 + ... + c_1 == E(pk, a)$or$c_1 + c_1 + ... + c_1 == E(pk, b)\$ etc...

1

This is an interesting question. If the input set does not have any identity element (for both mul and add operations) then one cannot construct a field and subsequently there cannot be homomorphic operations. More clearly, if the input plaintext elements do not form a field (and their respective ciphertext elements do not form a field either) then there ...

1

I have a definition of COA-security in my head but I cannot find this definition (applied to public key cryptography) in the literature or reference books. Under it, textbook RSA is an example of a public key cryptosystem that is COA-secure but not CPA-secure. To be CPA-secure, a necessary but not sufficient property is that encrypting the same message ...

Only top voted, non community-wiki answers of a minimum length are eligible