I have some code that takes a list of credit-card numbers, splits the number into two chunks, one chunk is 8 characters long, the other chunk is the remainder.

Each series of chunks is saved into individual files, for example my test data looks like (these are test CC numbers):


So, file X would contain:


and file Y would contain:


Each record is separated by a common delimiter (a newline character).

File X is saved to a TrueCrypt volume using AES, and file Y is saved to a different TrueCrypt volume, also using AES, but using a completely unrelated key.

My question is, does doing this lower cryptographic strength due to this structure?

The reason why I bring this up is that if you know the contents of one file, you can make assertions about the contents of the second, due to credit-card numbers adhering to LUHN-10 (mod10) specifications.

For example, if I know file X's contents, I know the corresponding record in file Y must pass the LUHN-10 check, and therefore knowing file X exposes information about file Y, Y's potential value is reduced by a factor of 10.

Slightly off-topic, but does storing a single file with full credit card numbers separated by a common delimiter expose information, if the attacker knows the structure of the file?


1 Answer 1


No, it doesn't lower security, but it doesn't (asimptotically) enhances it either. AES (or better, as Thomas pointed out, the way aes is used inside Truecrypt) is secure against IND-CPA attacks, so the encryption of a file itself does not reveal ANY information about the plaintext, except for its length.

Even if an adversary knows 99 bits of a 100 bits encrypted file (but not the encryption key), it cannot find the last bit without iterating trough the whole set of keys. Knowing something about the plaintext does not help the adversary.

  • $\begingroup$ "AES" is certainly not IND-CPA secure. A probabilistic encryption scheme such as CBC, CTR, OFB, .. is. $\endgroup$
    – Thomas
    Jan 22, 2013 at 8:19
  • $\begingroup$ You are right. AES itself is just a (trapdoor) permutation. I think the way AES is used in Truecrypt (XTS mode) is IND-CPA. $\endgroup$
    – antosecret
    Jan 22, 2013 at 8:24
  • $\begingroup$ Indeed, it is IND-CPA secure - I just wanted to clarify that point. $\endgroup$
    – Thomas
    Jan 22, 2013 at 8:29
  • $\begingroup$ Thanks for the suggestion! I briefly updated the answer to include that, feel free to expand and edit it if you wish. =) $\endgroup$
    – antosecret
    Jan 22, 2013 at 8:32
  • $\begingroup$ Thank you, your last line "Knowing something about the plaintext does not help the adversary." was what I was looking for. $\endgroup$
    – Matthew
    Jan 22, 2013 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.