# Symmetric encryption with compromised key but partially compromised message

Consider a symmetric encryption algorithm like ChaCha20 thats uses 512-bit blocks and a 128-bit key. Normally we study the security of the algorithm for the case where the cyphertext block is known to the attacker but the key is not, but what about a different case? Imagine the key is fully compromised, but only some bits of the cyphertext are known to the attacker. If 256 bits of the cyphertext are known, what's the cost of cracking the original message? What if 384 bits of the cyphertext are known instead?

Have problems of this type been studied before? References are welcome.

• If the key is fully known (you seem to say that's assumed) then you just decrypt the ciphertext, no?.You need to define your scenario exactly for an answer to be possible. We can't read your mind Commented Jun 11 at 0:55
• Sorry about that, I thought my description was clear. I edited my question, is it clear now? Commented Jun 11 at 2:08
• @DanielTurizo Your description is indeed clear, it's just this is an unusual situation that occurs in no reasonable context in cryptography, that we can't get our heads around what you're actually intending to ask. If your intention is literal, then the answer is simple, "what's the cost of cracking the original message": the cost is trivially none, as you already have the key. If you want reference, you can check out the keywords: "Kerckhoff's principle". Commented Jun 11 at 2:59
• I'm assuming the ChaCha20! ChaCha20 is a stream cipher built-in CTR mode, this means that the plaintext is x-ored with the key stream. Then knowing, the key produces the keystream. Let's assume we have 512-bit ciphertext in which only the first 256 bits are known. We can decrypt the first 256-bit, the rest is who knows, we only have the keystream. Commented Jun 11 at 17:49