Regular scenario

Let's say I have secret files which I will encrypt. The resulting container will be shared and might be intercepted. Not good, but that's okay - that's why I encrypted the data in the first place.

Scenario in question

However, now, I'll encrypt and share the same data again. With the same passphrase. The container will be different (because the key changed) but the data inside it is identical. And the attacker knows this. Does this open the encryption to any vulnerabilities from a cryptographical standpoint?

Pardon my lack of technical terms. I guess this would be a ciphertext-only attack? But modified in a way that each plaintext (my data, my files) prior to encryption is the same?

(It's a general question, the encrypted container might be from dm-crypt/LUKS or VeraCrypt or even an encrypted ZIP archive. But I think all of them are using 256-bit AES.)

  • 1
    Cross-posted on security and already has an answer there. And, better suites there. – kelalaka Dec 1 at 21:00
  • @kelalaka Well, it's a similar question but not the same. Did you read the answer there? – Jayjayyy Dec 1 at 21:02
  • If the keys are not related then an attacker could simply encrypt himself and make the ciphertext insecure. That would be weird, no? If the keys are related then knowledge of one key could lead to knowledge on another key, and security could be breached. – Maarten Bodewes Dec 1 at 22:08
  • @MaartenBodewes But does it help in any way to know the plaintext is the same in both cases? Like having "another equation" to help solving the mathematical task of cracking the encryption. And if you have more and more containers you'll have more and more ciphertexts corresponding to the same plaintext. Do you understand where I'm coming from? I'm a little lost at how to explain it better. – Jayjayyy Dec 2 at 12:08
up vote 3 down vote accepted

...but the data inside it is identical. And the attacker knows this. Does this open the encryption to any vulnerabilities from a cryptographical standpoint?

No. If it did, then encryption would not be very useful.

In fact, modern encryption schemes are designed to be secure even if:

  • The adversary already knows the plaintext that the ciphertext represents (known plaintext attack - KPA)
    • Where "secure" means they cannot recover the key or learn any information from other ciphertexts
  • The adversary can choose plaintexts, submit them to be encrypted, and obtain the resultant ciphertexts (chosen plaintext attack - CPA)
  • The adversary can choose ciphertexts, submit them to be decrypted, and obtain the resultant plaintexts (chosen ciphertext attack - CCA)

Even in all of these scenarios, a modern cipher will remain secure. Not only will it protect the plaintext from discovery, no adversary will even be able to distinguish a ciphertext from a random stream of bits with a non-negligible probability.

As long as the encryption provider is:

  • using a competent algorithm (such as AES-256 mentioned in the question)
  • in an appropriate mode of operation (e.g. an authenicated mode such as GCM)(edit: AEAD is apparently not relevant in this scenario)
  • and handles initialization vectors appropriately

then the messages will remain as secure as the passphrase that protects them. How secure the passphrase is will depend on how long/complex it is, combined with how the key is derived from it.

  • Containers like the ones OP described usually use XTS, not GCM or any AEAD. – forest Dec 2 at 7:25
  • Thank you for the detailed answer. When you say "No. If it did, then encryption would not be very useful." do you mean that in a practical or theoretical way? Because I read that a vulnerability is defined as anything which makes the cracking better than brute-force. And a KPA on AES seems to reduce the time - admittedly while still not being a viable attack. Do I understand that right? It seemed to me like your answer says that AES isn't vulnerable to KPA, CPA or CCA at all. – Jayjayyy Dec 2 at 12:15
  • @Jayjayyy Both - Can you cite a paper that uses known plaintext attack on full AES to reduce the cost of breaking it to lower than $2^{128}$? (It must be in an applicable attack model - the related key attack model is not relevant to encryption). Most papers attack reduced round versions of the cipher. The only successful attack on the full cipher I know of is the Biclique attack; But if I recall correctly, that only improves the time cost of breaking AES by 1 or 2 bits or so, while the total cost (time*area product) is worse than a generic attack. – Ella Rose Dec 2 at 17:28
  • en.wikipedia.org/wiki/Biclique_attack I just read a little bit about it. This is fascinating. Thanks again. :-) – Jayjayyy Dec 2 at 19:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.