Questions tagged [known-plaintext-attack]
The attacker knows at least one sample of both the plain text and the cipher text.
183
questions
0
votes
0
answers
63
views
Attack against stream cipher (LFSR with ASCII)
I'm reading Understanding Cryptography by Christof Paar and Jan Pelzl. In chapter 2 (Stream Ciphers) there's a question that goes like this:
Assume we have a stream cipher whose period is quite short....
- 123
0
votes
1
answer
46
views
Do attackers need to know what ciphers are being used when conducting ciphertext-only, known plaintext, chosen plaintext, and chosen ciphertext attack
I am trying to understand the basic ingredients needed to conduct various types of cryptanalytical attacks.
For instance, I understand that for Ciphertext-Only Attacks (COA) an attacker only has ...
- 3
1
vote
1
answer
50
views
AES-128-CFB repeated IV and KPA
I'm doing reverse-engineering a product and identified a critical issue with it. The work is done and the developer was notified, but for my own personal curiosity, I'd like to learn how to exploit it ...
1
vote
1
answer
124
views
Is AES GCM without GMAC vulnerable against known plaintext attack?
Is AES GCM without GMAC vulnerable against bit-flip attacks? Let's assume the plaintext is known for some reason (e.g. it can be guessed). In my opinion, I can flip bits in the ciphered blocks and can ...
- 1,447
5
votes
1
answer
187
views
What were Alan Turing and their team searching before doing KPA in the movie "The imitation game"?
I just watched the movie "The imitation game" (2014) which is based on Alan Turing's biography.
At some point in the movie the machine built by Turing wasn't fast enough to decrypt the ...
- 153
1
vote
1
answer
184
views
KPA-Security definition
In cryptography there are 4 basic attack classifications:
Ciphertext-Only Attack
Known-Plaintext Attack
Chosen-Plaintext Attack
Chosen-Ciphertext Attack
In Katz & Lindell's textbook (2nd edition)...
- 1,492
1
vote
1
answer
43
views
Is it allowable to put a restriction on the length of the plaintext used in the known-plaintext attack?
The definition of the known-plaintext attack: I have a plaintext and I can encrypt it to have its ciphertext, then I use this pair to break the cipher.
The question:
The only thing I further assume is ...
- 435
4
votes
1
answer
110
views
Number of plaintext–ciphertext pairs needed to rule out false keys with a reasonable likelihood in AES
I am new to cryptography and I've got the following question from Understanding Cryptography:
Imagine that aliens — rather than abducting earthlings and performing strange experiments on them — drop a ...
1
vote
2
answers
247
views
Known Plaintext attacks using standard greetings etc
In all modern ciphers, even if one bit of input changes, then half of the output will change because of diffusion. Considering this, how exactly will knowing standard salutations, etc. ("Hello ...
- 1,637
0
votes
0
answers
196
views
Known Plain Text Attack DES-OFB on Crack.sh
I am trying to do a known plaintext attack on DES-OFB through crack.sh. I have been having trouble lately. I keep getting blank text file back with no keys returned. Does anybody know if DES-OFB is ...
- 1
0
votes
0
answers
201
views
Known plaintext attack on AES with CBC
Assume I have a plaintext and a ciphertext, encrypted using some key and AES with CBC mode. I don't have a service, that I can send something to, so I can't use the Padding Oracle attack. Are there ...
- 1
0
votes
0
answers
35
views
How to falsify RSA signature with known message [duplicate]
I have a question about the RSA signature.
Let's say Alice has $(d,n)$ as the private key and $(e,n)$ as the public key. In order to sign a message $m$, Alice computes $y = m^d \bmod n$ and sends $(m,...
- 1
3
votes
1
answer
140
views
Combining CTR and ECB modes to prevent attacks
In Reusing AES-CTR Keys and IVs for File Encryption, the OP was asking about a composite encryption scheme $$C_i = E_K\left(P_i \oplus E_K\left(IV + i\right)\right)$$ which is basically just a CTR ...
- 229
0
votes
1
answer
302
views
Consequences of AES-GCM always encrypting the same plaintext
I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.
Regarding the authentication protocol, I made the following observations:
The plaintext ...
- 31
0
votes
0
answers
335
views
How to perform a known plaintext attack?
I have got the following documents:
(1) The plaintext
(2) The ciphertext
(3) The python program used to encrypt/decrypt the text
My goal is to find the key that was used to encrypt the plaintext into ...
3
votes
1
answer
126
views
How much information do I leak if I upload multiple ciphertexts with cleartext overlaps?
Suppose that $t_1, t_2, \ldots, t_n$ are my clear texts. Suppose that for any $(i,j) \in \{1,2,\ldots,n\}^2$, $t_i$ and $t_j$ only differ in, say, the 1st $m$-many characters. Finally, suppose that I ...
- 519
0
votes
1
answer
128
views
Safety of encryption when knowing part of the content [duplicate]
I want to encrypt a JSON file while exposing its interface (the name of the object fields) in clear text.
Since this exposes part of the content of the file, my guess is that an attacker could use ...
- 103
2
votes
2
answers
108
views
Construction of a "simple", nothing-up-my-sleeves, provably KPA resistant symmetric cipher
Why is AES secure? Apparently there is no answer - Why is AES resistant to known-plaintext attacks?.
With this in mind, one would obviously want a cipher that is mathematically provable to be ...
- 463
0
votes
0
answers
88
views
RNG to hide some bits
Suppose I have a sequence of bits of length M. I need to hide N out of M bits (hiding means forcing them to be 0) using RNG with a key. How I can relate the output of RNG to the number and positions ...
- 35
1
vote
0
answers
47
views
Memory required for known plaintext attack on general block cipher
Consider a block cipher on binary strings of length $k$ and keys which can be any binary string of length $n$. With $k2^n+k$ memory we can store all key/ciphertext pairs for a fixed plaintext and this ...
- 305
0
votes
2
answers
78
views
would this be classed as a cipher text attack?
Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter
any plaintext and observe the result of encryption.
would it be ...
- 1
10
votes
4
answers
775
views
One round of AES-128
Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext ...
- 305
2
votes
1
answer
157
views
Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?
I read Quite a lot document about breaking AES using CPA.
But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes.
My question is if the AES-...
- 23
1
vote
1
answer
51
views
Is it safe to distribute different portions of the same data encrypted with different AES keys?
Assume I have a block of data consisting of three segments A, B and C. With "segments" I mean a particular section of a bit stream, so if the whole binary data was simply ...
- 155
6
votes
3
answers
990
views
Is the ChaCha20 block function reversible using known plaintext?
I've been recently implementing the chacha20 stream cipher with Poly1305. As the core operations which make up the Quarter Round of chacha20 (ARX - Addition Rotation Xor) are indeed reversible, does ...
- 898
2
votes
1
answer
784
views
How does one conduct a known-plaintext attack on an algorithm?
My question is two-fold:
Say I am given a total black box and I have n number of plaintexts as inputs that map directly to $n$-number of ciphertexts as outputs. This is all I know, and I do not have ...
- 165
3
votes
1
answer
338
views
How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?
If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:
...
- 898
0
votes
1
answer
354
views
Recognizing and decrypting custom cipher with known plaintext and ciphertext
I've been trying to reconstruct an encryption algorithm that produces a known ciphertext from a know plaintext. I have done some analysis:
the algorithm operates on single bytes
a plain text can be ...
- 19
1
vote
0
answers
53
views
Known plain-text attack on Kerberos
This is a form of the Kerberos protocol
I have two questions. Why does this protocol give the opportunity of a known plain-text attack because of no authentication of Joe? And how would an attacker ...
- 11
3
votes
0
answers
321
views
Why are cyclic keys in Feistel Networks insecure?
So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the ...
- 165
1
vote
1
answer
444
views
XChacha20poly1305 vulnerability to known plaintext attacks
During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
- 11
2
votes
1
answer
133
views
Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0? [duplicate]
I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of ...
- 21
2
votes
0
answers
1k
views
Known Plain-text Attack [closed]
How can I find the known plain text P2 based on the given information? Assuming that the encryption is made using a common initialization vector and the mode used for encryption is OFB.
...
- 21
2
votes
0
answers
156
views
Encrypted ZIP and plain text attack [duplicate]
I have a Zip archive containing a single password-protected file file.txt.
The encryption is "ZIP 2.0 Default Encryption" (ZipCrypto).
I know what kind of text (...
- 21
3
votes
1
answer
215
views
Why is the Domingo-Ferrer cryptosystem not used in practice?
The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
- 33
2
votes
0
answers
72
views
Known-plaintext attack against E0 with 2745 bits per frame instead of 24
In the paper The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption, an attack against the E0 cipher is described which can break it efficiently in a known-plaintext attack:
...
- 13.3k
1
vote
1
answer
91
views
Cipher recommendation for known-plaintext attack
I need to encrypt a 4-digit number. The cipher-text can be up to 11 digits long and there are no limits for the key size.
Considering that the attacker has access to both the cipher-text and the ...
- 13
2
votes
1
answer
362
views
How many required known plaintexts for an attack are considered insecure?
I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit.
When I was looking at more common block ciphers with a 64 bit, I learned that ...
- 123
2
votes
1
answer
2k
views
Hill cipher: How to find an unknown key of unknown size
How would you tackle the problem of finding the key (you don't know the length) to a Hill cipher when knowing only one 12-letter word of plaintext and its corresponding ciphertext?
CONVERSATION has ...
0
votes
0
answers
70
views
Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?
Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ?
(assuming the first form exists)
$P^aQ^bR^c \mod N$
With $P^...
- 475
0
votes
1
answer
50
views
How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?
To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$.
$c = mg_1^r$ mod p
If an ...
- 475
1
vote
1
answer
277
views
IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)
I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode.
Assuming I have:
The ability to arbitrary encrypt known plaintexts
The IV
I know ...
- 111
0
votes
1
answer
702
views
how to compute IV with AES CTR if key, plaintext and ciphertext are known?
Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
- 3
0
votes
0
answers
61
views
Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]
In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
- 113
1
vote
0
answers
519
views
show that G' is not a secure PRG even if G is
Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is.
My first question is that in this case, how do I know what G ...
- 111
2
votes
1
answer
1k
views
AES-CBC ciphertext manipulation with known IV and plaintext! [duplicate]
I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin"...
- 23
2
votes
0
answers
98
views
Is my deniable encryption scheme reasonable?
I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
- 121
8
votes
3
answers
11k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 191
6
votes
1
answer
231
views
On CPA & KPA security of $\boxplus$-Feistel
I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given:
$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a ...
- 1,990
1
vote
1
answer
1k
views
Known Plaintext Attack for Modified OFB Mode of Operation
Question: Assume a variant of the OFB mode by which we only feedback the 8 most significant bits of the cipher output. We use AES and fill the remaining 120 input bits to the cipher with 0's:
Why is ...
- 859