I have some code that takes a list of credit-card numbers, splits the number into two chunks, one chunk is 8 characters long, the other chunk is the remainder.

Each series of chunks is saved into individual files, for example my test data looks like (these are test CC numbers):


So, file X would contain:


and file Y would contain:


Each record is separated by a common delimiter (a newline character).

File X is saved to a TrueCrypt volume using AES, and file Y is saved to a different TrueCrypt volume, also using AES, but using a completely unrelated key.

My question is, does doing this lower cryptographic strength due to this structure?

The reason why I bring this up is that if you know the contents of one file, you can make assertions about the contents of the second, due to credit-card numbers adhering to LUHN-10 (mod10) specifications.

For example, if I know file X's contents, I know the corresponding record in file Y must pass the LUHN-10 check, and therefore knowing file X exposes information about file Y, Y's potential value is reduced by a factor of 10.

Slightly off-topic, but does storing a single file with full credit card numbers separated by a common delimiter expose information, if the attacker knows the structure of the file?


No, it doesn't lower security, but it doesn't (asimptotically) enhances it either. AES (or better, as Thomas pointed out, the way aes is used inside Truecrypt) is secure against IND-CPA attacks, so the encryption of a file itself does not reveal ANY information about the plaintext, except for its length.

Even if an adversary knows 99 bits of a 100 bits encrypted file (but not the encryption key), it cannot find the last bit without iterating trough the whole set of keys. Knowing something about the plaintext does not help the adversary.

| improve this answer | |
  • $\begingroup$ "AES" is certainly not IND-CPA secure. A probabilistic encryption scheme such as CBC, CTR, OFB, .. is. $\endgroup$ – Thomas Jan 22 '13 at 8:19
  • $\begingroup$ You are right. AES itself is just a (trapdoor) permutation. I think the way AES is used in Truecrypt (XTS mode) is IND-CPA. $\endgroup$ – antosecret Jan 22 '13 at 8:24
  • $\begingroup$ Indeed, it is IND-CPA secure - I just wanted to clarify that point. $\endgroup$ – Thomas Jan 22 '13 at 8:29
  • $\begingroup$ Thanks for the suggestion! I briefly updated the answer to include that, feel free to expand and edit it if you wish. =) $\endgroup$ – antosecret Jan 22 '13 at 8:32
  • $\begingroup$ Thank you, your last line "Knowing something about the plaintext does not help the adversary." was what I was looking for. $\endgroup$ – Matthew Jan 22 '13 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.