Skip to main content

Questions tagged [known-plaintext-attack]

The attacker knows at least one sample of both the plain text and the cipher text.

Filter by
Sorted by
Tagged with
0 votes
0 answers
73 views

Help Needed with Chosen Plaintext Attack on AES-CTR

I'm working on a cryptanalysis project for my professor, and I need some guidance. The assignment involves implementing one of the following types of attacks on a ciphertext encrypted with a symmetric ...
deomanu01's user avatar
1 vote
1 answer
98 views

Is it possible to break a DSA with k that increases statically?

I am currently studying cryptography. I came across this problem: I had an exercise that as a vulnerability had that k is generated every 10 seconds: ...
Edoardo's user avatar
  • 11
0 votes
0 answers
89 views

Is known plaintext on Zipcrypto still possible using BK94 algorithm?

In my recent tests both pkcrack and bkcrack are no longer working, maybe it's my PC. I have zipped pkcrack.exe and chose compression level as store on both ...
terry franklin's user avatar
1 vote
1 answer
83 views

Is it impossible to improve plaintext attack on Zip crypto in trade of memory vs plaintext bytes requirement?

BKcrack and BK94 states that a minimum of 12 bytes plaintext is required to perform the attack but that was more than 20 years ago, even Michael Stay's improvement is not utilizing modern resources ...
terry franklin's user avatar
0 votes
1 answer
257 views

Advantages of AES vs XOR on a plain text file

Currently, I am using AES-GCM to encode and decode a plain text file. The key is derived from a plain text password using PBKDF2 and a random salt with SHA-256. However, I have been thinking and came ...
Hubert's user avatar
  • 1
1 vote
2 answers
342 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 343
0 votes
1 answer
59 views

Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography

I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
gabe_torres's user avatar
2 votes
0 answers
39 views

How many ciphertexts should attacker intercepts if he only knows the first 3 bytes of plaintext of each one?

Consider a system in which DES is used to encrypt messages in which the first three plaintext Bytes are known by the attacker. How many encrypted messages is it necessary to intercept in order to be ...
Allexj's user avatar
  • 143
5 votes
1 answer
368 views

How to recover ring settings for the slow and the middle rotors on Enigma Checking Machine?

Summary: The operation of the Enigma Bombe is well documented. I manage to use it and a candidate checking machine to recover the plugboard pairs and the ring setting for the fast rotor. I struggle to ...
Chan Tai Man's user avatar
1 vote
1 answer
165 views

DES attack with known partial plaintext

Consider a system where DES is used to encrypt HTTP GET requests. The first three bytes correspond to the character sequence "GET". How many encrypted messages is it necessary to intercept ...
Angelo's user avatar
  • 13
6 votes
1 answer
285 views

A modern rotor machine, could it be any safe?

I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions: A rotor machine which consists of 50 rotors picked out of a set of 100. A rotor ...
Princeofmillerovo's user avatar
1 vote
0 answers
71 views

Non-uniform plaintext distribution -- AES attack

Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform? Most of the work assume that the plaintext is ...
nivedita's user avatar
0 votes
2 answers
67 views

Attack on AES/DES [duplicate]

Can we devise an attack on AES or DES (ECB mode) if we know just the distribution for the plaintext? For example, it is a English plain text -- we know what that would look like and the relative ...
nivedita's user avatar
2 votes
0 answers
78 views

1st round attack on rc4

I'm trying to implement the 1st round attack on RC4 stream cipher according to Attacks on the RC4 stream cipher. For now I am interested in section 4.2 Attack on other key bytes. It works really fine ...
SarkoxedaF's user avatar
1 vote
0 answers
156 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
1 vote
1 answer
683 views

Why is ECB mode unsafe if the key is kept secret?

this is my first post so I apologise if the formatting of my post isn't perfect. I should start off by saying that this post is not for any malicious intent, rather for curiosity and understanding AES ...
Shafin Kamal's user avatar
1 vote
0 answers
250 views

Determining the initial positions of Engima's rotors

We want to perform a known plaintext attack on the enigma M3, the goal is to reach the initial settings of the 3 rotors. I tried to bruteforce those values since I know the plaintext, ciphertext, ...
Khalil's user avatar
  • 11
2 votes
1 answer
143 views

Clarification on expected number of plaintext, ciphertext pairs needed to identify AES keys

I'm aware of the many questions on this topic, but I'm still not sure what went wrong with my reasoning here below. I'm assuming use of AES with key size $2^{256}$ and messages of size $2^{128}$, ...
Anon's user avatar
  • 403
1 vote
1 answer
162 views

Clarification regarding Rabin Cryptosystem being CPA (Chosen Plaintext Attack) secure

Do I understand correctly that the textbook Rabin encryption scheme, where there is no random padding (as is also required in RSA for it to be CPA secure), is not CPA secure? (it is deterministic ...
Anon's user avatar
  • 403
3 votes
1 answer
775 views

AES with a different implementation of byte substitution step

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me: suggested a new implementation for AES: The byte substitution step will be ...
gabi's user avatar
  • 31
0 votes
0 answers
293 views

Attack against stream cipher (LFSR with ASCII)

I'm reading Understanding Cryptography by Christof Paar and Jan Pelzl. In chapter 2 (Stream Ciphers) there's a question that goes like this: Assume we have a stream cipher whose period is quite short....
KetDog's user avatar
  • 123
0 votes
1 answer
126 views

Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack

I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks. For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
Leviel's user avatar
  • 3
1 vote
1 answer
366 views

AES-128-CFB repeated IV and KPA

I'm doing reverse-engineering a product and identified a critical issue with it. The work is done and the developer was notified, but for my own personal curiosity, I'd like to learn how to exploit it ...
CryptoInquisitor's user avatar
1 vote
1 answer
771 views

Is AES GCM without GMAC vulnerable against known plaintext attack?

Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
MichaelW's user avatar
  • 1,497
6 votes
2 answers
478 views

What were Alan Turing and their team searching before doing KPA in the movie "The imitation game"?

I just watched the movie "The imitation game" (2014) which is based on Alan Turing's biography. At some point in the movie the machine built by Turing wasn't fast enough to decrypt the ...
melfnt's user avatar
  • 163
1 vote
1 answer
845 views

KPA-Security definition

In cryptography there are 4 basic attack classifications: Ciphertext-Only Attack Known-Plaintext Attack Chosen-Plaintext Attack Chosen-Ciphertext Attack In Katz & Lindell's textbook (2nd edition)...
Titanlord's user avatar
  • 2,327
1 vote
1 answer
48 views

Is it allowable to put a restriction on the length of the plaintext used in the known-plaintext attack?

The definition of the known-plaintext attack: I have a plaintext and I can encrypt it to have its ciphertext, then I use this pair to break the cipher. The question: The only thing I further assume is ...
Crypt01's user avatar
  • 417
4 votes
1 answer
727 views

Number of plaintext–ciphertext pairs needed to rule out false keys with a reasonable likelihood in AES

I am new to cryptography and I've got the following question from Understanding Cryptography: Imagine that aliens — rather than abducting earthlings and performing strange experiments on them — drop a ...
userabc123abc123's user avatar
1 vote
2 answers
574 views

Known Plaintext attacks using standard greetings etc

In all modern ciphers, even if one bit of input changes, then half of the output will change because of diffusion. Considering this, how exactly will knowing standard salutations, etc. ("Hello ...
user93353's user avatar
  • 2,200
0 votes
0 answers
310 views

Known Plain Text Attack DES-OFB on Crack.sh

I am trying to do a known plaintext attack on DES-OFB through crack.sh. I have been having trouble lately. I keep getting blank text file back with no keys returned. Does anybody know if DES-OFB is ...
user avatar
0 votes
0 answers
535 views

Known plaintext attack on AES with CBC

Assume I have a plaintext and a ciphertext, encrypted using some key and AES with CBC mode. I don't have a service, that I can send something to, so I can't use the Padding Oracle attack. Are there ...
Anegng's user avatar
  • 1
0 votes
0 answers
36 views

How to falsify RSA signature with known message [duplicate]

I have a question about the RSA signature. Let's say Alice has $(d,n)$ as the private key and $(e,n)$ as the public key. In order to sign a message $m$, Alice computes $y = m^d \bmod n$ and sends $(m,...
John's user avatar
  • 1
3 votes
1 answer
279 views

Combining CTR and ECB modes to prevent attacks

In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
ManRow's user avatar
  • 343
0 votes
1 answer
854 views

Consequences of AES-GCM always encrypting the same plaintext

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages. Regarding the authentication protocol, I made the following observations: The plaintext ...
Kobodjo's user avatar
  • 31
0 votes
0 answers
544 views

How to perform a known plaintext attack?

I have got the following documents: (1) The plaintext (2) The ciphertext (3) The python program used to encrypt/decrypt the text My goal is to find the key that was used to encrypt the plaintext into ...
Holly Iveburn's user avatar
3 votes
1 answer
171 views

How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?

Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
caveman's user avatar
  • 573
0 votes
1 answer
152 views

Safety of encryption when knowing part of the content [duplicate]

I want to encrypt a JSON file while exposing its interface (the name of the object fields) in clear text. Since this exposes part of the content of the file, my guess is that an attacker could use ...
SystematicFrank's user avatar
2 votes
2 answers
142 views

Construction of a "simple", nothing-up-my-sleeves, provably KPA resistant symmetric cipher

Why is AES secure? Apparently there is no answer - Why is AES resistant to known-plaintext attacks?. With this in mind, one would obviously want a cipher that is mathematically provable to be ...
super's user avatar
  • 463
0 votes
0 answers
91 views

RNG to hide some bits

Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
Riva11's user avatar
  • 35
0 votes
2 answers
85 views

would this be classed as a cipher text attack?

Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter any plaintext and observe the result of encryption. would it be ...
hithere's user avatar
11 votes
4 answers
2k views

One round of AES-128

Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext ...
user avatar
2 votes
1 answer
343 views

Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?

I read Quite a lot document about breaking AES using CPA. But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes. My question is if the AES-...
Lee Anon's user avatar
1 vote
1 answer
58 views

Is it safe to distribute different portions of the same data encrypted with different AES keys?

Assume I have a block of data consisting of three segments A, B and C. With "segments" I mean a particular section of a bit stream, so if the whole binary data was simply ...
LWChris's user avatar
  • 155
8 votes
3 answers
5k views

Is the ChaCha20 block function reversible using known plaintext?

I've been recently implementing the chacha20 stream cipher with Poly1305. As the core operations which make up the Quarter Round of chacha20 (ARX - Addition Rotation Xor) are indeed reversible, does ...
Aravind A's user avatar
  • 1,030
2 votes
1 answer
2k views

How does one conduct a known-plaintext attack on an algorithm?

My question is two-fold: Say I am given a total black box and I have n number of plaintexts as inputs that map directly to $n$-number of ciphertexts as outputs. This is all I know, and I do not have ...
the_endian's user avatar
3 votes
1 answer
569 views

How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?

If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows: ...
Aravind A's user avatar
  • 1,030
0 votes
1 answer
707 views

Recognizing and decrypting custom cipher with known plaintext and ciphertext

I've been trying to reconstruct an encryption algorithm that produces a known ciphertext from a know plaintext. I have done some analysis: the algorithm operates on single bytes a plain text can be ...
Pruzo's user avatar
  • 19
1 vote
0 answers
76 views

Known plain-text attack on Kerberos

This is a form of the Kerberos protocol I have two questions. Why does this protocol give the opportunity of a known plain-text attack because of no authentication of Joe? And how would an attacker ...
nmq's user avatar
  • 11
3 votes
0 answers
532 views

Why are cyclic keys in Feistel Networks insecure?

So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the ...
Lukor's user avatar
  • 165
1 vote
1 answer
1k views

XChacha20poly1305 vulnerability to known plaintext attacks

During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
Chacha123's user avatar

1
2 3 4 5