Hot answers tagged

27

A known-plaintext attack (i.e. knowing a pair of corresponding plaintext and ciphertext) always allows a brute-force attack on a cipher: Simply try all keys, decrypt the ciphertext and see if it matches the plaintext. This always works for every cipher, and will give you the matching key. (For very short plaintext-ciphertext pairs, you might get multiple ...


20

It's the difference between an active and a passive attacker: Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as plaintext xor ciphertext. Chosen plaintext attack: The attacker can ...


20

if a cipher has a known-plaintext attack, then it is considered completely broken. Yes, pretty much... [Paraphrased] But can't we come up with a case where this isn't true, such as a One Time Pad? Yes, we can come up with cases like that; however the requirements of such a case (key as long as the plaintext, no key reuse) make such a cipher ...


16

If the user changes the key for every message sent, then what use is a known-plaintext attack? Stop right there. This is not what we are trying to prove when conducting a known-plaintext attack. A known-plaintext attack is one where we are given a bunch of ciphertexts, all stemming from encryption using a fixed key. We are then given one plaintext/...


14

As far as is publicly known, no, you can't. If you could, that would constitute a practical known-plaintext key recovery attack on AES, and the existence of such an attack would mean that AES would be considered totally insecure by modern cryptographic standards. If you do figure out how to do that, publish it and you'll be famous. (Or, if you'd prefer ...


14

These aren't "attacks" in and of themselves, they are simply a way to classify attacks depending on how many assumptions they make. For instance, if an attack requires plaintext-ciphertext pairs to recover the key, but they don't have to be any particular pairs, that attack is categorized as a known-plaintext attack. However if another attack required the ...


11

Do all ciphers suffer from the problem of multiple equivalent decryption keys? No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very high there is a very big chance that ciphers do not have equivalent keys. This is especially true for ciphers with a high block size (AES with 128 bits). Even ...


10

I suspect that KCV's are in general not used because they don't add enough to be worth the small overhead. There are a number of cryptographical attacks on encrypted methods that involve the attacker modifying a valid ciphertext, and then having the receiver decrypt the modified message (and watch how the receiver reacts). Because of these attacks, it is ...


10

No matter how bad a protocol built on top of RSA is, there is no known risk that a private key leaks from valid plaintext/ciphertext pairs, even if the adversary chooses plaintext or ciphertext; that's one of RSA's virtues. Thus to the question is it possible with this information for Cindy to find $pri_A$ we can answer: as far as we know, no; and more, ...


10

AES-256 has sustained 15 years of cryptanalysis, and it can be stated that no knowledge of some plaintext bytes would help to reveal the other bytes no matter what mode of operation (CBC, CTR, etc.) is used. AES-GCM is an authenticated encryption scheme that allows a key holder to detect any modification that has been done to the ciphertext. If you do not ...


10

When using CTR Mode the AES is used to generate a kind of key stream which itself is the XORed to your plaintext. So AES is actually encrypting an incrementing counter. At the moment there is no known attack, that would yield E(N) if you do know E(N-1), where N is the aforementioned counter. So this should be safe. But be aware, as the plaintext is XORed ...


10

No, padding would make the message much easier to crack. This is a great example of why cryptography is left to the professionals (I am not a professional cryptographer, I'm not even a very good amateur one). Amateurs tend to just make things worse. First problem is the Enigma had no way to produce a "null". It was only capable of producing letters. ...


8

I know no published attack against the XTEA algorithm, much less one working with a few plaintext/ciphertext pairs and a random key. There are published attacks against reduced variants of XTEA, AFAIK either with much less than half of the 64 rounds, or up to 36 rounds but assuming related or/and weak keys in addition of known plaintext. Often, especially ...


8

Eli Biham examined this, along with a long series of other "internal chaining" modes in the paper "Cryptanalysis of Multiple Modes of Operation" in AsiaCrypt 1994. His conclusion was that there were ways of attacking such modes that were strictly easier than the standard "external chaining" mode that is now commonly used; his paper is the chief reason that ...


8

For a meet-in-the-middle attack with known plaintext, you break all $K_i$ at the same time. The goal is to split the work into multiple sides, trading off some exponential work for some exponential space and some linear work. Split the encryption and decryption sides evenly. You need $(2^8)^4 \times 2 = 2^{33}$ block cipher calls, because you need 4 layers ...


8

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...


7

No for practical definitions of possible, assuming the key was chosen truly randomly, and no side-channel information is available (such as the power-consumption traces of the encrypting device, or the time it took, for many encryptions). The design of AES strives to be such that the best way to find the key from plaintext-ciphertext examples is to try keys ...


7

If a popular encryption scheme is being used: No. The typical solution is that symmetric stream/block ciphers generate a constant stream of new pseudo-random bits which are merged/XOR'd with the plaintext to produce the ciphertext. The pseudo-random stream is seeded indirectly by the private key - so as long as the previous or future bits of the PRNG can ...


7

If you are using a modern, secure cipher, there is no reason whatsoever to perform such manipulations of the plaintext. I'm not sure how to elaborate much more on the topic than that. The entire purpose of a cipher is to perform the exact types of confusion and diffusion you describe. Only, the approach that it will use has been designed, peer-reviewed, and ...


7

As Stephen already said in his answer, if you use a modern secure encryption scheme, then you do not have to worry about the confidentiality of the messages. However, as you say your application is a chat the following part of your question: if I add some extra bytes to the message seems to be a valid (although maybe "paranoid") issue. I interpret ...


6

Well, the answer to 'why is AES resistant to known-plaintext attacks' is that, well, lots of really bright people have thought hard about how to break AES, and no one has come up with a practical way, either assuming known plaintext or chosen plaintext. See how-much-would-to-cost-to-brute-force-AES for a discussion on what it would take, given the current ...


6

Could the attacker figure out the AES key if the IV used to encrypt all the strings is the same? No; the AES key is secure against such an attack. Could the attacker figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known? No, the AES key is secure against such an attack. You say that you are ...


6

If we note $|m|$ the number of bits in the bytestring coding the message $m$, the first padding considered is $m\mapsto \tilde m=257\cdot2^{|m|}+m$, and the signature is $m\mapsto\tilde S(m)=S(\tilde m)=\tilde m^d\bmod N$, where $S$ is the textbook/naked RSA signing $m\mapsto m^d\bmod N$. Notice that for any $m$ small enough that $m^2$ can be signed, we can ...


5

Well, no, modern ciphers (such as AES) do not share that weakness; they are designed specifically to be secure without any assumption of what the plaintext looks like. You can encrypt the same message with multiple keys; in fact, you can encrypt the same message a bunch of times with the same key, and the attacker still cannot deduce any information for ...


5

If the encryption is any good, no. What you're describing is a known-plaintext (or possibly chosen-plaintext) key recovery attack, and any encryption system that was even suspected of being vulnerable to such attacks would be considered hopelessly broken by modern standards. The "gold standard" that modern encryption methods aim for is generally taken to ...


5

Well, I went and solved the puzzle using brute force and Maple. I won't spoil the actual answer, but here are some tips that ought to make the process a bit more quicker. Solving the linear system modulo 2 gives you the parity of the second and third letters of the unknown plaintext. Note that all vowels in the English alphabet map to even numbers using ...


5

There is no general method for that. Cryptography is about making it impossible in practice. In the particular examples, it looks like "encrypted data" is encoded in Base64, as 22 characters, representing 128 arbitrary bits. From that it can't be deduced much about the scheme used.


5

Probably not in this case, although not for the reason you gave. As @Sadeq points out in the comments, AES is resistant to known-plaintext attacks. This means that by simply knowing M+P or P (the entire plaintext you've encrypted) it should not be possible to recover the AES key. However, key recovery isn't the only attack and it raises a deeper question: ...


5

Simply put no. As per the abstract, those attacks take at most 4 bits off the key space, this still results minimally in 124 bits of security. Put another way, to use these attacks you would need to expend effort roughly proportional to brute forcing an AES key where you already knew four bits of the key and this would take approximately $2^{124}$ ...


5

You got three equations with two unknowns ($k$ and $x$). You only need two signatures to solve the private key $x$: $s_1k \equiv h_1 + xr_1 \pmod q$ $s_2k + s_2 \equiv h_2 + xr_2 \pmod q$ This might be solved using Gaussian elimination. Step 1: $s_1k/r_1 \equiv h_1/r_1 + x \pmod q$ - Divide 0.1 by $r_1$ $s_2k + s_2 - s_1kr_2/r_1 \equiv h_2 - h_1r_2/...



Only top voted, non community-wiki answers of a minimum length are eligible