What are the dangers of predictable (repeated) plaintext structures?

Question

When using a "good", modern cipher (specifically one that provides ciphertext indistinguishability), is it a problem at all if there is some well-known structure in all plaintexts?

For example, consider a simple protocol that transmits many messages that all start with an identical, but secret string. All of the messages are encrypted with a different symmetric key, and the keys are in no way correlated (to either plaintext or previous keys).

Is there a way for an attacker to use his knowledge of the fact that the first n bytes of ciphertext always correspond to the same plaintext? Can those bytes even be decrypted? If so, is there a specific term for that kind of attack/cipher weakness? (Maybe something like "known identical plaintext"?)

My background for asking is section 5 of RFC 4345, which specifically advises against using RC4 in that kind of scenario. I know that RC4 has some known weaknesses regarding ciphertext indistinguishability, and it seems that my scenario is exactly one where those would allow the plaintext to be recovered.

So my question, in other words, is: Do other ciphers like AES share that weakness? If not, does resistance against that weakness, however it is called, follow from the fact that a cipher provides ciphertext indistinguishability?

Answer 1

Well, no, modern ciphers (such as AES) do not share that weakness; they are designed specifically to be secure without any assumption of what the plaintext looks like. You can encrypt the same message with multiple keys; in fact, you can encrypt the same message a bunch of times with the same key, and the attacker still cannot deduce any information for what the plaintexts look like (or indeed verify that all those ciphertexts did in fact correspond to the same plaintext).

As for specific terminology for an attack that, given a large number of messages, attempts to find some information about them, I have seen the term "statistical cryptanalysis"; I don't know how commonly that is used.

As for resistance to AES with a secure mode to statistical cryptanalysis, one way to derive it is indeed based on ciphertext indistinguishability. If the cipher mode does provide ciphertext indistinguishability (that is, the ciphertexts corresponding to chosen plaintexts are indistinguishable from random outputs), then any process that gains any information on the plaintexts based on the ciphertexts leads immediately to a distinguisher (as doing the same analysis on truely random outputs can't give any information about the plaintext), and such a distinguisher contradicts the assumption of ciphertext indistinguishability.