Consider a symmetric encryption algorithm like ChaCha20 thats uses 512-bit blocks and a 128-bit key. Normally we study the security of the algorithm for the case where the cyphertext block is known to the attacker but the key is not, but what about a different case? Imagine the key is fully compromised, but only some bits of the cyphertext are known to the attacker. If 256 bits of the cyphertext are known, what's the cost of cracking the original message? What if 384 bits of the cyphertext are known instead?

Have problems of this type been studied before? References are welcome.

Thanks in advance.

  • 2
    $\begingroup$ If the key is fully known (you seem to say that's assumed) then you just decrypt the ciphertext, no?.You need to define your scenario exactly for an answer to be possible. We can't read your mind $\endgroup$
    – kodlu
    Commented Jun 11 at 0:55
  • $\begingroup$ Sorry about that, I thought my description was clear. I edited my question, is it clear now? $\endgroup$ Commented Jun 11 at 2:08
  • 1
    $\begingroup$ @DanielTurizo Your description is indeed clear, it's just this is an unusual situation that occurs in no reasonable context in cryptography, that we can't get our heads around what you're actually intending to ask. If your intention is literal, then the answer is simple, "what's the cost of cracking the original message": the cost is trivially none, as you already have the key. If you want reference, you can check out the keywords: "Kerckhoff's principle". $\endgroup$
    – DannyNiu
    Commented Jun 11 at 2:59
  • 1
    $\begingroup$ I'm assuming the ChaCha20! ChaCha20 is a stream cipher built-in CTR mode, this means that the plaintext is x-ored with the key stream. Then knowing, the key produces the keystream. Let's assume we have 512-bit ciphertext in which only the first 256 bits are known. We can decrypt the first 256-bit, the rest is who knows, we only have the keystream. $\endgroup$
    – kelalaka
    Commented Jun 11 at 17:49

1 Answer 1


Often the plaintext & therefore ciphertext message is larger than the key. Usually the amount of bits in the ciphertext message is as large as the plaintext message + possibly some overhead.

For most ciphers knowing the key will allow you to decrypt any part of the message. It mainly depends on the type of cipher and mode of operation how you can do this, but the principle remains.

If the ciphertext cannot be known then we may assume that the plaintext message can also not be known if it is protected in the same way. So what you are saying is that the part of the ciphertext message that remains unavailable is secure. First of all, that might not be the case as the message may be recoverable from the part of the message that is known.

But even more importantly: in that case you might as well not encrypt the message as the plaintext would remain unknown as well.

In conclusion: no this is not something we consider in cryptography, nor do we need to as we have semantically secure ciphers. Is it studied? Well no, we understand these properties and take them for granted.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.