Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have a cryptosystem that I'm using for secure chat.
It is using AES 256 (with RSA 2048 for key exchange).
Would a predictable, and repetitively sent ciphertext plaintext compromise the cryptosystem?
For example, if Eve knows that the string "Username: testuser" is sent with each message (making it predictable), would that compromise the system?
Or something like an "html" tag at the very beginning?
Yes, if your ciphertext is repetitive, that's bad.
We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is kind of bad. Or it could be e.g. because you're using AES in CTR mode with a fixed IV, which would be worse. Or, in principle, you might be using a deterministic authenticated encryption mode like SIV without a nonce, which would be almost OK (although, for a chat application, even the minimal information leakage of nonce-less SIV would seem undesirable).
But, in any case, a modern semantically secure encryption scheme should never produce repetitive ciphertext, not even if the plaintext repeats. If yours does, it's a sign that you're using AES wrong somehow.
As a corollary, as long as the encryption method you're using is resistant to chosen-plaintext attacks (which turns out to be equivalent to semantic security), it does not matter what the plaintext is or how many times it's repeated, not even if the attacker gets to choose the plaintext.
Most standard AES modes of operation (with the exception of ECB) are provably secure against chosen-plaintext attacks, as long as the AES block cipher itself is not broken and as long as they're used correctly — i.e. the IV / nonce is chosen appropriately for the mode, and never reused, and the maximum amount of data encrypted with a single key is not exceeded (not that a typical chat application is likely to come anywhere close to doing that).
(However, if an attacker can intercept and manipulate the encrypted messages (and/or inject their own fake messages into the communication), they may be able to modify the messages in transit and to carry out chosen-ciphertext attacks, which the classical non-authenticated modes of operation like CBC, CFB, OFB and CTR are not resistant to. To protect yourself against such attacks, you either need to combine them with a message authentication code, or use an authenticated encryption mode that, in effect, has the encryption and authentication parts combined into a single standardized bundle.)
