If I have the unencrypted text and the encrypted text, can I calculate the key? It seems logical based on my limited knowledge of encryption that I should be able to... but it also seems like too obvious of a vulnerability for it to be possible.

Could someone explain how encryption schemes prevent against this type of vulnerability?


2 Answers 2


It depends completely on the encryption algorithm in use - for some little examples have a look below the horizontal rule.

In general, this is called a Known Plaintext Attack. The attacker has access to a message $m$ and its encryption $c=E_k(m)^{[1]}$. The stronger form of this attack is a Chosen Plaintext Attack (CPA), where the attacker gets to choose $m$ and have it encrypted for him.

Assuming you've observed at least one character, if the encryption is a caeser Cipher then yes: it would be sufficient to recover the key. This is because you can take the difference between the first character of the plaintext and ciphertext to find the key.

However, even with the Vigenère Cipher, which is a slight 'improvement' on the Caeser Cipher, this might not be sufficient. If the key is longer than the plaintext/ciphertext pair you have observed, then you will not learn anything about the latter part of the key. Similar examples come from thinking simply in terms of information: if you only witness $b$ bits of output, no matter how useful they are you can only learn at most $b$ bits of the key$^{[2]}$. Thus if the key $k>b$ bits long, there is no way $b$ bits of output can be sufficient to discern it.


  1. Where $E_k(m)$ is the encryption of $m$ under key $k$.
  2. I assume here that the key is in some sense minimal. That is, the bits of the key are randomly set, and we have no information about the form the key takes. For example, if we know the key is either $0000$ or $1111$, then even though the key is $4$ bits long, it is determinable from $1$ bit.

For any competently design cryptosystem the answer is no.

The attacker knowing the plain-text that corresponds to a particular cipher-text does not leak any information about the key (with very high probability).

In fact, even if the attacker can choose the plain-texts you encrypt and obtains the ciphertexts for those, he still shouldn't be able to learn any information about the key.

You can go even further than this again. Say the attacker has a cipher-text $c_0$ that he wants the decryption for. You give the attacker the ability to obtain the encryption of any message of his choice message and to execute the decryption process on any cipher-text of his choice (except $c_0$ of course). Even with this much power, he still shouldn't learn anything about the key or the plain-text message that $c_0$ decrypts to.

So in summary, yes, the attack you mentioned has been catered for all in modern cryptosystems. In fact, cryptographers design schemes that are secure even when the attacker has almost unrealistic/supernatural power.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.