0
$\begingroup$

We are contemplating hiding a sensitive information from our business partner by encrypting it.

However, customers have access to both the sensitive and the encrypted information. Furthermore, they can influence the 'sensitive information' to their liking.

I am curious which security algorithms are sensitive to an attacker being able to encrypt whatever they choose to (and see the result). Also, is there a known guide (or a googleable name) of this property of crypto algorithms?

$\endgroup$
1
  • 1
    $\begingroup$ Are you looking for an encryption algorithm that is not breakable? If the attacker doesn't know the symmetric key of a secure symmetric algorithm like AES, they can not encrypt correctly. $\endgroup$ – kelalaka Sep 10 '20 at 14:58
3
$\begingroup$

This is called a Chosen Plaintext Attack (or CPA for short) where the attacker can obtain the ciphertext for arbitrary plaintext.

A modern cipher should be CPA-resistant. For example, AES-CBC with a proper random IV is IND-CPA. But be aware that there are many other types of security levels, CPA is just one of them.

You can find a good overview of crypto algorithms and their basic properties in these security guidelines

$\endgroup$
5
$\begingroup$

I am curious which security algorithms are sensitive to an attacker being able to encrypt whatever they choose to (and see the result).

No algorithm would be considered secure if they could be broken under that assumption.

Also, is there a known guide (or a googleable name) of this property of crypto algorithms?

There's a couple of different names (based on some fairly subtle distinctions); the most common is probably "IND-CPA", which stands for "indistinguishable from random against chosen plaintext attacks", that is, even if the attacker was allowed to submit large number of plaintexts of their choosing and get them encrypted, they still would be unable to obtain any information about the encryption method (it'd still look "random")

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.