When knowing the full content of the original message, will I be able to derive the private key from the encrypted message when the underlying encryption uses a fixed initialization vector?

Meaning if we encrypt by Text UNENCRYPTED x Private Key =[fixed IV]=> Text ENCRYPTED, can we somehow calculate the key backwards by Text ENCRYPTED % Text UNENCRYPTED =[fixed IV]=> Private Key, considering a fixed IV is used?

If the answer is no, please explain why this is not possible. If the answer is yes, will the calculated key really be the private key or just a local solution to this particular message, not suitable to decrypt other texts encrypted with the same unknown private key? (The latter would mean something like: Text ENCRYPTED % Text UNENCRYPTED =[fixed IV]= Pseudo Private Key != Private Key)

(You might also note differently: fx(Text UNENCRYPTED, Private Key) = Text ENCRYPTED, so if fy(Text ENCRYPTED, Text UNENCRYPTED) = Private Key, how to get from the function fx to fy? If a fixed IV would not allow this, please mention some other encryption methods with which this backwards calculation would be possible)


1 Answer 1


What you're describing is called a known-plaintext attack, and any secure encryption algorithm should prevent this. If we take an encryption function with no IV $C = ENC(M, K)$ we should get a system where knowing both $M$ and $C$ reveals nothing about $K$.

We can expand this principal to $C = ENC(M \oplus IV, K)$ and simplify it back to the example without an IV; $M \oplus IV$ simply becomes our new $M$ (you could say $M' = M \oplus K$). This principal applies also for $C = ENC(M \oplus IV) \oplus IV$.

Any encryption algorithm which fails to achieve this property cannot be considered secure, and as such in your scheme $K$ will not be leaked if the encryption algorithm used is secure.

However, using a fixed IV is bad practice since it allows statistical analysis attacks (read about it here). While $K$ may not be leaked $M$ might leak from statistical patterns.

  • $\begingroup$ From the linked wiki article, it sounds like the potential problem is that someone who has the ciphertext can learn things about the original message M. Would that still be true if the message was very short, like just an integer, and not many kilobytes of possibly repeated data blocks? $\endgroup$ Apr 22, 2021 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.