I know that in the KPA the attacker has access to both the plaintext and the ciphertext, but in the end it all comes down to performing an exhaustive key search. I'm not sure if having the corresponding plaintext for a given ciphertext makes such an attack any less laborious. So I wonder, are they equally effective? And why do we make this distinction if they're practically identical?
7
-
2$\begingroup$ Obviously depends on the system under consideration. $\endgroup$– fkraiemFeb 22, 2018 at 5:08
-
$\begingroup$ @fkraiem can you elaborate? $\endgroup$– TreyFeb 22, 2018 at 5:47
-
$\begingroup$ Yes for some systems; no for others. $\endgroup$– fkraiemFeb 22, 2018 at 6:04
-
1$\begingroup$ In particular, what fkraiem was pointing out was that "but in the end it all comes down to performing an exhaustive key search" need not be true, depending on the system under consideration. $\endgroup$– ponchoFeb 22, 2018 at 8:00
-
2$\begingroup$ Note that within some systems, e.g. RSA with OAEP encryption, the plaintext candidate is automatically verified. In that case having known plaintext doesn't do much. Then again, if you have just AES-CTR mode encryption without any known plaintext information (i.e. just random looking plaintext to an attacker) then the result cannot be verified at all. If a system is vulnerable against known plaintext attacks then it is likely that there are some vulnerabilities that do not require exhaustive key search; I think this is what fkraiem and poncho are trying to communicate. $\endgroup$– Maarten Bodewes ♦Feb 22, 2018 at 12:34
|
Show 2 more comments
1 Answer
$\begingroup$
$\endgroup$
Usually we are talking about various attacks which are better than brute force, these attacks can very greatly depending on what we can do. Ciphertext only is usually the most restrictive setting. Known Plain text where we have several plain&cipher text pairs is common. But we also have other attack modes. chosen cipher text, adaptive chosen plain text and mode.
If we take some classical ciphers for example. We will see a significant difference between the cipher text only and known plain text attacks. We know how to perform ciphertext only attacks on Viginere or substitution ciphers using only statistical knowledge about the plain text such as letter frequencies. But with a known plain text the key is trivially revealed. In Viginere subtract the cipher from plain and receive a repeating key. Without any tricks for finding key length or matching column frequencies.
Even with the simplest ciphers we see differences.
Also with modern attacks, different attacks published require different kinds of access. For a more modern example, let's look at a stream cipher with a limited internal state. For instance A5 family used for cell phone encryption. With cipher text only we don't have much to do in the way of generic attacks. we can brute force internal state and do a crib drag over cipher text to see if we find something that looks like plain text. However when we know parts of the plain text (and we almost always do, due to protocols used and other reasons). We can do better, we can get parts of the key stream by xoring the known plain text with the cipher text. And not only brute force the internal state more efficiently looking for matches in the key-stream fragments we have, we can even off load most of the work and do Time-Memory-Date trade-off attack.
Better access, often leads to better more efficient attacks, though these are still specific to the cipher of cipher family.
