Questions tagged [known-plaintext-attack]

The attacker knows at least one sample of both the plain text and the cipher text.

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

Generating RSA keys with plain and ciphertext [duplicate]

I have plaintext and ciphertext. Is it possible to generate an RSA key pair that encrypts the plaintext to ciphertext and decrypts ciphertext to plaintext. I don't need to find the original key pair ...
1
vote
0answers
34 views

Memory required for known plaintext attack on general block cipher

Consider a block cipher on binary strings of length $k$ and keys which can be any binary string of length $n$. With $k2^n+k$ memory we can store all key/ciphertext pairs for a fixed plaintext and this ...
0
votes
2answers
57 views

would this be classed as a cipher text attack?

Say i'm given a cipher text to decrypt, however i also have access to a server that performed the encryption; where i could enter any plaintext and observe the result of encryption. would it be ...
7
votes
2answers
175 views

One round of AES-128

Maybe it’s a silly question, I’m interested in the best known/chosen plaintext attack on only one round of AES-128. More specifically, what is the smallest number of known/chosen plaintext/ciphertext ...
2
votes
1answer
45 views

Is it possible to perform CPA(Correlation Power Analysis) when attacker has only specific round's waveform?

I read Quite a lot document about breaking AES using CPA. But most of them, assuming that attacker has the first or last round of the waveform(trace) and exploit SubBytes. My question is if the AES-...
1
vote
1answer
35 views

Is it safe to distribute different portions of the same data encrypted with different AES keys?

Assume I have a block of data consisting of three segments A, B and C. With "segments" I mean a particular section of a bit stream, so if the whole binary data was simply ...
2
votes
2answers
1k views

JSON AES-128: Security against known plaintext attack

I have a system where I am transmitting JSON messages securely (using for example AES-128), where each message has the same format. For example: ...
2
votes
1answer
123 views

How does one conduct a known-plaintext attack on an algorithm?

My question is two-fold: Say I am given a total black box and I have n number of plaintexts as inputs that map directly to $n$-number of ciphertexts as outputs. This is all I know, and I do not have ...
5
votes
2answers
129 views

Is the ChaCha20 block function reversible using known plaintext?

I've been recently implementing the chacha20 stream cipher with Poly1305. As the core operations which make up the Quarter Round of chacha20 (ARX - Addition Rotation Xor) are indeed reversible, does ...
3
votes
1answer
143 views

How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?

If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows: ...
0
votes
1answer
85 views

Recognizing and decrypting custom cipher with known plaintext and ciphertext

I've been trying to reconstruct an encryption algorithm that produces a known ciphertext from a know plaintext. I have done some analysis: the algorithm operates on single bytes a plain text can be ...
1
vote
0answers
26 views

Known plain-text attack on Kerberos

This is a form of the Kerberos protocol I have two questions. Why does this protocol give the opportunity of a known plain-text attack because of no authentication of Joe? And how would an attacker ...
3
votes
0answers
119 views

Why are cyclic keys in Feistel Networks insecure?

So everyone seems to agree that recurring round keys in a Feistel network (eg. using the same key for every round) are a massive security leak. When researching this, the only thing I found is the ...
0
votes
2answers
144 views

Reversability of Xor'd Values In Hash?

This may be a dumb question so please forgive me if so, but is a hash function considered one-way even if you have half of an xor'd value? For example say I have the values R and C, both are randomly ...
1
vote
1answer
121 views

XChacha20poly1305 vulnerability to known plaintext attacks

During a security audit, the guy said our cryptosystem is vulnerable to known-plaintext attacks. He said that's because «the implementation uses a crypto_stream_xor() approach» (from libsodium). That'...
1
vote
1answer
57 views

Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0? [duplicate]

I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of ...
2
votes
0answers
209 views

Known Plain-text Attack [closed]

How can I find the known plain text P2 based on the given information? Assuming that the encryption is made using a common initialization vector and the mode used for encryption is OFB. ...
9
votes
1answer
10k views

Breaking ZIP 2.0 encryption without password

I have an old sourcecode backup from my DOS days stored in a ZIP 2.0 encrypted archive, but I lost the password. The password was written on a paper slip, but I remember that it consisted of 30+ ...
2
votes
0answers
72 views

Encrypted ZIP and plain text attack [duplicate]

I have a Zip archive containing a single password-protected file file.txt. The encryption is "ZIP 2.0 Default Encryption" (ZipCrypto). I know what kind of text (...
19
votes
1answer
4k views

What do the signature security abbreviations like EUF-CMA mean?

From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes. The most common ones are the *UF-* ...
3
votes
1answer
4k views

Known plaintext attack on ElGamal encryption [closed]

Assume that Alice uses Bob’s ElGamal public key $(\alpha=2, \beta = 8, P= 11)$ to send two messages $M = 17$ and $M' = 37$ using the same random integer $k = 9$. Eve intercepts the ciphertext and ...
3
votes
1answer
137 views

Why is the Domingo-Ferrer cryptosystem not used in practice?

The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
1
vote
1answer
135 views

Ethereum RLPx protocol for inter-node communication - flaws in the encryption

Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref) Under Known-Issues I found this paragraph: The RLPx ...
7
votes
3answers
6k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
2
votes
0answers
48 views

Known-plaintext attack against E0 with 2745 bits per frame instead of 24

In the paper The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption, an attack against the E0 cipher is described which can break it efficiently in a known-plaintext attack: ...
2
votes
1answer
177 views

How many required known plaintexts for an attack are considered insecure?

I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit. When I was looking at more common block ciphers with a 64 bit, I learned that ...
1
vote
1answer
78 views

Cipher recommendation for known-plaintext attack

I need to encrypt a 4-digit number. The cipher-text can be up to 11 digits long and there are no limits for the key size. Considering that the attacker has access to both the cipher-text and the ...
0
votes
0answers
31 views

What are some best practices to handle user password in shell script and environment variables?

I'm new to this community. Currently im working on a project which involves handling user password in shell script. Following steps describe my password consumption flow: Get password from user ...
2
votes
1answer
238 views

Hill cipher: How to find an unknown key of unknown size

How would you tackle the problem of finding the key (you don't know the length) to a Hill cipher when knowing only one 12-letter word of plaintext and its corresponding ciphertext? CONVERSATION has ...
5
votes
2answers
8k views

RC4 , Is it possible to find the key if we know the plaintext and ciphertext?

Is it possible to find the key if we know the plaintext and ciphertext with RC4. How should I write the algorithm?
0
votes
0answers
56 views

Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?

Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ? (assuming the first form exists) $P^aQ^bR^c \mod N$ With $P^...
0
votes
1answer
45 views

How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?

To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$. $c = mg_1^r$ mod p If an ...
0
votes
2answers
2k views

What's wrong with RSA and OpenSSL?

We all know that signing a document is to encrypt its hash using signer's private key. https://commons.wikimedia.org/wiki/File:Digital_Signature_diagram.svg I've been searching the web for days, ...
11
votes
2answers
2k views

KCV and compatibility with block cipher modes of operation

There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV. ...
1
vote
1answer
119 views

IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)

I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode. Assuming I have: The ability to arbitrary encrypt known plaintexts The IV I know ...
0
votes
1answer
259 views

how to compute IV with AES CTR if key, plaintext and ciphertext are known?

Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
0
votes
0answers
35 views

Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]

In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
1
vote
0answers
241 views

show that G' is not a secure PRG even if G is

Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is. My first question is that in this case, how do I know what G ...
2
votes
1answer
561 views

AES-CBC ciphertext manipulation with known IV and plaintext! [duplicate]

I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin"...
2
votes
0answers
85 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
4
votes
2answers
1k views

Determine AES key given encrypted and unencrypted files

Given an encrypted file, the original unencrypted (cleartext) file, and knowledge of which AES encryption algorithm was used, is it possible to determine the key that was used to encrypt the data in a ...
49
votes
6answers
37k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
6
votes
1answer
3k views

Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
1
vote
1answer
711 views

Known Plaintext Attack for Modified OFB Mode of Operation

Question: Assume a variant of the OFB mode by which we only feedback the 8 most significant bits of the cipher output. We use AES and fill the remaining 120 input bits to the cipher with 0's: Why is ...
4
votes
1answer
1k views

Known Plaintext Attack on Block Cipher in ECB and CBC Modes of Operations

These 2 similar questions are from Paar's Understanding Cryptography. I could not see the answer so if someone can help I will appreciate: Question1: We consider known plaintext attacks on block ...
2
votes
3answers
575 views

Known-plaintext attack on 1-round Feistel networks

Consider a simple, 1-round Feistel network. Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$. However round functions in ...
1
vote
1answer
129 views

It's safe to store a known value (for checking) next to the actually encrypted values

The high level details of the encryption I'm using is: AndroidKeyStore create/store RSA key AES key is created and wrapped with RSA/ECB/PKCS1Padding Encrypted AES is saved to disk. Data is encrypted ...
2
votes
1answer
187 views

Is Paillier secure from known plaintext attack for single character message?

Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3. Does that mean that c1=c2=c3 in cipher-text from ? If not, how many times can I encrypt a message m=1 and still ...
1
vote
1answer
530 views

Clarification on Hill Cipher crib dragging technique

--- this has been edited as I realised the question was silly. replaced with helpful information --- I want to confirm the following: Given ciphertext "AGHTDIX... [cont.]" (C) and crib (a word ...
1
vote
0answers
29 views

Would it possible to decode an intelligible but alien message? [duplicate]

I've been reading some sci-fi and there is a frequent mention of decoding alien signals. From what i read historically in ww2 for decoding enemy message the allies would transmit fake information ...