I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how these two differ?
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ Welcome to Cryptography Stack Exchange. Your question was migrated here because of being related to the more theoretic parts of cryptography, which are on-topic here (and not so much on Security Stack Exchange). Please register your account here, too, to be able to comment and accept an answer. $\endgroup$– Paŭlo EbermannJun 10, 2012 at 20:31
-
$\begingroup$ Very similar (but a bit more general) question: crypto.stackexchange.com/questions/13274/… $\endgroup$– Ilmari KaronenMay 30, 2016 at 16:37
Add a comment
|
4 Answers
$\begingroup$
$\endgroup$
5
It's the difference between an active and a passive attacker:
Known plaintext attack: The attacker knows at least one sample of both the plaintext and the ciphertext. In most cases, this is recorded real communication. If the XOR cipher is used for example, this will reveal the key as
plaintext xor ciphertext.Chosen plaintext attack: The attacker can specify his own plaintext and encrypt or sign it. He can carefully craft it to learn characteristics about the algorithm. For example he can provide an empty text, a text which consists of one "a", two "aa", ... For example: if the Vigenère cipher is used, it is very easy to extract the key length and recover the key by repeating one letter.
So the second type of attack is a lot more powerful.
answered Jun 10, 2012 at 17:20
-
3$\begingroup$ And just for completeness, note that the "known plaintext" is a special case of "chosen plaintext". $\endgroup$– B-ConJun 10, 2012 at 23:39
-
-
$\begingroup$ @Hendrik, So which encryption protects against chosen plaintext attack? Is that even possible? $\endgroup$– PacerierFeb 16, 2015 at 23:17
-
$\begingroup$ @Pacerier AES is so far considered secure under CPA. Note that Hendrik notes that a scheme is CPA secure if you cannot learn something useful during such an attack. "Clearly" that is the case as AES produces a completely different output if even one bit of changed. $\endgroup$ Mar 8, 2016 at 10:44
-
$\begingroup$ @Hendrik : So "known plaintext attack" can be applied only on stream ciphers, not on block ciphers (AES, DES etc). Please tell me, am I right ? $\endgroup$– rashokAug 12, 2016 at 15:45
$\begingroup$
$\endgroup$
2
A known plaintext attack is that if you know any of the plaintext that has been encrypted and have the resulting encrypted file, with a flawed encryption algorithm you can use that to break the rest of the encryption.
Example: We saw this with the old pkzip encryption method. In this case if you had any of the unencrypted files in the archive, you could use that to obtain the key to break the rest.
A chosen plaintext attack is the same thing except you get to choose the plaintext which can be useful. In this case the attacker determines what will be encrypted and then uses the result to determine the key (or perhaps other less useful information) of the encryption.
Example: A good example here is XOR encryption. If you can choose the plaintext and get to see the result, you can use those to easily determine the key being used.
You could also use a known plaintext attack with non-salted hashes. So if I choose a password and can see the resulting hash, I could search to see if there are any other similar hashes and therefore know they have the same password.
So yeah they are basically the same thing, its really just a matter of what you have to work with or what you are trying to accomplish.
-
$\begingroup$ +1, but xor is the standard example for known-plaintext based attacks:
cyphertext = key xor plaintextimplieskey = plaintext xor cyphertext. $\endgroup$ Jun 10, 2012 at 22:04 -
1$\begingroup$ If you know plaintext $X$ and its encrypted form $Y$ where $Y = X \oplus Z$, $Z$ being the key, then the key is recoverable as $X \oplus Y$, and whether you get to choose $X$ (as in a chosen plaintext attack) or just have some arbitrary $X$ that you chanced upon (as in a known plaintext attack) is completely irrelevant. You could ease your life slightly by choosing a plaintext $X = 0$ to get the key as $Y$ directly (as opposed to doing a $X\oplus Y$ as in a known plaintext attack), but I think that is not much of an advantage. $\endgroup$ Jun 10, 2012 at 22:08
$\begingroup$
$\endgroup$
4
As others have pointed out, there are some ciphers that can be broken if all you have is a known plaintext and the ciphertext. In general, because of this, those ciphers are considered very vulnerable and are not used anywhere. Or I should say, where they are used, the keys are generated (pseudo-) randomly and only used once.
However, if the attacker can choose the plaintext, more commonly used ciphers become insecure. In particular Public-Key cryptography has a glaring weakness in this regard, because signing a plaintext is exactly the same operation as decrypting a ciphertext. If an attacker can get a target to sign a message anyone encrypted with the target's public key (i.e. sent to the target) and retrieve the signature, then the attacker has recovered the plaintext of the message. This is one reason digital signature schemes are set up to only sign a hash of the message, not the entire message itself.
In more sophisticated attacks, using large numbers of chosen plaintexts can reveal patterns in the ciphertext that in turn reveal some if not all of the bits of the key. Usually, though, the number of chosen plaintexts is huge: millions to trillions or more.
A cipher that is vulnerable to known plaintext attacks is of course vulnerable to chosen plaintext attacks, but more importantly can be broken without any access to the encryption device. Intercepting the communications alone compromises the cipher. On the other hand, chosen plaintext attacks do require access to the encryption device, and thus are considered secure as long as the encryption device itself is secure.
-
2$\begingroup$ “Signing a plaintext is exactly the same operation as decrypting a ciphertext”: only if you do it wrong. For example, RSA-OAEP is an asymmetric encryption algorithm, RSA-PSS is an asymmetric signature algorithm, raw RSA is not a cryptographic algorithm but a building block for one. (The padding scheme isn't the only thing that distinguishes RSA-based signature and encryption algorithm; Schneier recommends using different public exponents, and common wisdom avoids using the same key for both purposes.) $\endgroup$ Jun 13, 2012 at 14:03
-
$\begingroup$ @Gilles, RSA is very much a cryptographic algorithm. Because of its many drawbacks, it's used as a building block, but it's not necessary to use anything else. The OP asked about chosen vs known plaintext attacks and one of the reasons RSA is used the way it is is because of the chosen plaintext attack it is vulnerable to, and thus it is a good example of how a chosen plaintext can do what a known plaintext cannot. $\endgroup$ Mar 24, 2014 at 22:27
-
$\begingroup$ Well, ok. Raw RSA is a cryptographic algorithm, but it isn't a (good) encryption or signature algorithm. The key point is that signing a plaintext is not the same operation as decrypting a ciphertext. They typically use different keys (because they should have different management policies), and the padding is different. $\endgroup$ Mar 24, 2014 at 22:59
-
$\begingroup$ @Giles, on the contrary, the key point is that in the most basic RSA public key cryptography, signing a plaintext is exactly the same mathematical operation as decrypting a ciphertext. Look it up. $\endgroup$ Mar 25, 2014 at 7:10
$\begingroup$
$\endgroup$
1
Known Plaintext Attack
You sniff a lot of thhing about your victim but every of them is ciphertext so you don't know anything about them. And you learn o plan text of your victim by any means; but you don't know the plaintext is which ciphertext's. So you must solve this problem.
Choosen Plaintext Attack
You know a plaintext and you know the plaintext is which cipertext's. And you try to solve the algorithm of encryption system.
-
1$\begingroup$ [-1] In a KPA you do know which message corresponds to which ciphertext. As such this answer is wrong. All that changes between these two games is who provides the list of messages $\endgroup$ Mar 24, 2014 at 10:38