Is it allowable to put a restriction on the length of the plaintext used in the known-plaintext attack?

Question

The definition of the known-plaintext attack: I have a plaintext and I can encrypt it to have its ciphertext, then I use this pair to break the cipher.

The question: The only thing I further assume is the length of the used known plaintext, not its content. Is this allowable in the known-plaintext attack?

A note: I think if it is not allowable, then the attack should work with whatever pair of plaintext and ciphertext the attacker has to deal with to the point of one-bit plaintext.

Answer 1

I would say this is no longer a known-plaintext attack.

My reasoning is to start with a ciphertext-only attack, and see what we can determine about the plaintext length.

• For most classical ciphers, the plaintext length and ciphertext length are equal, and for algorithms like Playfair or ADFGVX the lengths may not be equal, but the plaintext length can be easily determined from the ciphertext, so the attacker doesn't really have any new information.
• [Edit] In some cases, such as "The world wonders" message, the length would be new information, but even then you don't know exactly where the real message begins and ends.
• For modern ciphers, the ciphertext would be (depending on the mode) some combination of IV, plaintext, padding, and authentication tag. The lengths of the IV and authentication tag would be known from the algorithm, so only the padding (if present) would be a new piece of information, and I don't see that as that much help.

The information available to the attacker is almost the same as a ciphertext-only attack, so I would call this a slightly enhanced ciphertext-only attack, rather than a known-plaintext attack.