# Tag Info

## Hot answers tagged known-plaintext-attack

17

A known-plaintext attack (i.e. knowing a pair of corresponding plaintext and ciphertext) always allows a brute-force attack on a cipher: Simply try all keys, decrypt the ciphertext and see if it matches the plaintext. This always works for every cipher, and will give you the matching key. (For very short plaintext-ciphertext pairs, you might get multiple ...

15

It's the difference between an active and a passive attacker: Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext. Chosen plaintext attack: The attacker can ...

8

No matter how bad a protocol built on top of RSA is, there is no known risk that a private key leaks from valid plaintext/ciphertext pairs, even if the adversary chooses plaintext or ciphertext; that's one of RSA's virtues. Thus to the question is it possible with this information for Cindy to find $pri_A$ we can answer: as far as we know, no; and more, ...

8

For a meet-in-the-middle attack with known plaintext, you break all $K_i$ at the same time. The goal is to split the work into multiple sides, trading off some exponential work for some exponential space and some linear work. Split the encryption and decryption sides evenly. You need $(2^8)^4 \times 2 = 2^{33}$ block cipher calls, because you need 4 layers ...

7

Eli Biham examined this, along with a long series of other "internal chaining" modes in the paper "Cryptanalysis of Multiple Modes of Operation" in AsiaCrypt 1994. His conclusion was that there were ways of attacking such modes that were strictly easier than the standard "external chaining" mode that is now commonly used; his paper is the chief reason that ...

7

I suspect that KCV's are in general not used because they don't add enough to be worth the small overhead. There are a number of cryptographical attacks on encrypted methods that involve the attacker modifying a valid ciphertext, and then having the receiver decrypt the modified message (and watch how the receiver reacts). Because of these attacks, it is ...

7

If a popular encryption scheme is being used: No. The typical solution is that symmetric stream/block ciphers generate a constant stream of new pseudo-random bits which are merged/XOR'd with the plaintext to produce the ciphertext. The pseudo-random stream is seeded indirectly by the private key - so as long as the previous or future bits of the PRNG can ...

7

If you are using a modern, secure cipher, there is no reason whatsoever to perform such manipulations of the plaintext. I'm not sure how to elaborate much more on the topic than that. The entire purpose of a cipher is to perform the exact types of confusion and diffusion you describe. Only, the approach that it will use has been designed, peer-reviewed, and ...

7

These aren't "attacks" in and of themselves, they are simply a way to classify attacks depending on how many assumptions they make. For instance, if an attack requires plaintext-ciphertext pairs to recover the key, but they don't have to be any particular pairs, that attack is categorized as a known-plaintext attack. However if another attack required the ...

6

Well, the answer to 'why is AES resistant to known-plaintext attacks' is that, well, lots of really bright people have thought hard about how to break AES, and no one has come up with a practical way, either assuming known plaintext or chosen plaintext. See how-much-would-to-cost-to-brute-force-AES for a discussion on what it would take, given the current ...

6

I know no published attack against the XTEA algorithm, much less one working with a few plaintext/ciphertext pairs and a random key. There are published attacks against reduced variants of XTEA, AFAIK either with much less than half of the 64 rounds, or up to 36 rounds but assuming related or/and weak keys in addition of known plaintext. Often, especially ...

6

Could the attacker figure out the AES key if the IV used to encrypt all the strings is the same? No; the AES key is secure against such an attack. Could the attacker figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known? No, the AES key is secure against such an attack. You say that you ...

6

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...

5

Well, no, modern ciphers (such as AES) do not share that weakness; they are designed specifically to be secure without any assumption of what the plaintext looks like. You can encrypt the same message with multiple keys; in fact, you can encrypt the same message a bunch of times with the same key, and the attacker still cannot deduce any information for ...

5

As far as is publicly known, no, you can't. If you could, that would constitute a practical known-plaintext key recovery attack on AES, and the existence of such an attack would mean that AES would be considered totally insecure by modern cryptographic standards. If you do figure out how to do that, publish it and you'll be famous. (Or, if you'd prefer ...

5

Simply put no. As per the abstract, those attacks take at most 4 bits off the key space, this still results minimally in 124 bits of security. Put another way, to use these attacks you would need to expend effort roughly proportional to brute forcing an AES key where you already knew four bits of the key and this would take approximately $2^{124}$ ...

5

If the encryption is any good, no. What you're describing is a known-plaintext (or possibly chosen-plaintext) key recovery attack, and any encryption system that was even suspected of being vulnerable to such attacks would be considered hopelessly broken by modern standards. The "gold standard" that modern encryption methods aim for is generally taken to ...

5

No proper modern encryption algorithm allows known-plaintext attacks. Even if the adversary knows all of the plaintext except one bit, and knows the ciphertext, that doesn't help him determine the value of that one unknown bit. If you use a cryptographic library then you're unlikely to use an algorithm that is broken in this sense, except ECB. Just make sure ...

4

You have to define precisely what Eve can and cannot do. For instance, has Eve occasional physical access to the Arduino-based device ? If yes, then she can (at least conceptually) grab the device, "open" it, extract the shared secret, and replace the device with one of here own which does the same job, except that it also sends a copy of the data to another ...

4

Your reasoning is correct. However, there is still some information to be exploited: as you know already, the matrix used to encrypt (the secret key) need to be invertible in order to allow decryption. Since you basically know (say) the first column and the second column of the secret key from your plaintext/ciphertext, you derive from the invertibility of ...

4

No for practical definitions of possible, assuming the key was chosen truly randomly, and no side-channel information is available (such as the power-consumption traces of the encrypting device, or the time it took, for many encryptions). The design of AES strives to be such that the best way to find the key from plaintext-ciphertext examples is to try keys ...

4

Well, I went and solved the puzzle using brute force and Maple. I won't spoil the actual answer, but here are some tips that ought to make the process a bit more quicker. Solving the linear system modulo 2 gives you the parity of the second and third letters of the unknown plaintext. Note that all vowels in the English alphabet map to even numbers using ...

4

You got three equations with two unknowns ($k$ and $x$). You only need two signatures to solve the private key $x$: $s_1k \equiv h_1 + xr_1 \pmod q$ $s_2k + s_2 \equiv h_2 + xr_2 \pmod q$ This might be solved using Gaussian elimination. Step 1: $s_1k/r_1 \equiv h_1/r_1 + x \pmod q$ - Divide 0.1 by $r_1$ $s_2k + s_2 - s_1kr_2/r_1 \equiv h_2 - ... 4 As Stephen already said in his answer, if you use a modern secure encryption scheme, then you do not have to worry about the confidentiality of the messages. However, as you say your application is a chat the following part of your question if I add some extra bytes to the message seems to be a valid (although maybe "paranoid") issue. I interpret this ... 4 This answer has been updated a lot, again, after being accepted. I now base my analysis on simple functional equivalent source code to the deterministic PRNG used. The cryptosystem proposed works, in the sense that it allows decryption. The best cryptanalytic method there is to predict further output is enumerating the 64-bit key by brute force. That's in ... 3 There are 18 plaintext and ciphertext letters$p_j$and$c_j$,$0\le j<18$(with$j<6$for the "first plaintext"), all of which are known except$p_7..p_{17}$. Let$M=\pmatrix{m_{0,0}&m_{0,1}&m_{0,2}\\m_{1,0}&m_{1,1}&m_{1,2}\\m_{2,0}&m_{2,1}&m_{2,2}}\$ be the key matrix (unknown, except that it is invertible). We have 18 linear ...

3

Known-plaintext attacks are key-recovery attacks. By design, an asymmetric cipher cannot be susceptible to known-plaintext attacks; it would be completely worthless. The property you describe that asymmetric ciphers such as textbook RSA lack is called semantic security. Some considerations: In practice, RSA might be used only to encrypt a randomly ...

3

What you are trying to do is called a known-plaintext attack. A proper cipher will not be susceptible to a known-plaintext attack, so if the encryption method used on the strings in your database is any good, it can't be done. Imagine that you were in fact using a (128 bit block) cipher that permits deducting the password given the plaintext and the ...

3

Probably not in this case, although not for the reason you gave. As @Sadeq points out in the comments, AES is resistant to known-plaintext attacks. This means that by simply knowing M+P or P (the entire plaintext you've encrypted) it should not be possible to recover the AES key. However, key recovery isn't the only attack and it raises a deeper question: ...

3

The classic attack using known plaintext essentially runs the encryption backwards and constructs the key. No brute force is needed, you just need enough matching plaintext and cyphertext, where "enough" can be as little as the key length (for sufficiently vulnerable cyphers). Resistant cyphers do internal mixing of the cypher state so this is not ...

Only top voted, non community-wiki answers of a minimum length are eligible