Questions tagged [known-plaintext-attack]
The attacker knows at least one sample of both the plain text and the cipher text.
45
questions
32
votes
1
answer
9k
views
What do the signature security abbreviations like EUF-CMA mean?
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.
The most common ones are the *UF-* ...
- 45.7k
59
votes
6
answers
54k
views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
- 795
18
votes
2
answers
27k
views
Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?
I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
- 183
9
votes
3
answers
16k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
17
votes
1
answer
19k
views
The difference between these 4 breaking Cipher techniques?
I'm trying to understand the difference between the following and what they actually mean :
Known plaintext attack
Known ciphertext attack
Chosen ciphertext attack
Chosen plaintext attack
Any ...
- 445
8
votes
2
answers
5k
views
DES — Can I recover the key when I have both ciphertext and the plaintext?
Given a message and DES encrypted form of said message, is it possible to efficiently compute the key used to encrypt the data?
- 183
7
votes
1
answer
5k
views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ($\left[...
- 283
9
votes
1
answer
18k
views
Breaking ZIP 2.0 encryption without password
I have an old sourcecode backup from my DOS days stored in a ZIP 2.0 encrypted archive, but I lost the password.
The password was written on a paper slip, but I remember that it consisted of 30+ ...
- 91
31
votes
4
answers
65k
views
What is the difference between known-plaintext attack and chosen-plaintext attack?
I am very confused between the concept of known-plaintext attack and chosen-plaintext attack. It seems to me that these two are the same thing, but it definitely is not.
Can anyone explain to me how ...
Tom Fabregas
12
votes
1
answer
5k
views
Sending KCV (key check value) with cipher text
I was wondering why it is not more common to send the KCV of a secret key together with the cipher text. I see many systems that send cipher text and properly prepend the IV to e.g. a CBC mode ...
- 91.7k
4
votes
1
answer
3k
views
Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext [duplicate]
I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are ...
- 165
14
votes
4
answers
7k
views
Why is a known-plaintext attack considered a complete break?
I read somewhere that if a cipher has a known-plaintext attack, then it is considered completely broken.
Say there is a cipher that someone uses where the algorithm is understood and a known-...
- 251
11
votes
2
answers
3k
views
KCV and compatibility with block cipher modes of operation
There has been lately a question on KCV (key check value), value provided by many CRYPTOKI (PKCS#11) implementations. I don't particularly like KCV, but I decided to ask about proper use of KCV.
...
- 5,309
7
votes
1
answer
5k
views
Using same modulus for RSA
I know that there exist some attack when using same modulus.
Can two different pairs of RSA key have the same modulus?
RSA cracking: The same message is sent to two different people problem
But ...
- 79
5
votes
2
answers
2k
views
Hill cipher, unknown letter value
I've been struggling on this problem for a while now : the Hill cipher is well-known to be vulnerable to known-plaintext attack due to its linearity. Given a key matrix $K$ of size $n\times n$, one ...
- 151
4
votes
3
answers
10k
views
Hill Cipher known plaintext attack
I know a plaintext - ciphertext couple of length 6 for a hill cipher where its key is a [3x3] matrix.
Based on what I've read and learned, to attack and crack keys of [n x n], if we know a plaintext -...
- 141
2
votes
1
answer
6k
views
Difference between known-plaintext attack and forward search attack
I am looking at the different attacks on RSA. I came across known-plaintext attack where the public key can be used to encrypt all possible messages until it finds a match on the sent encrypted ...
- 123
1
vote
1
answer
2k
views
With HMAC, can an attacker recover the key, given many known plaintext/tag pairs?
Given many pairs of $(m, t)$, can the attacker compute the key $k$ satisfying $\text{HMAC}(k,m) = t$? (Assume that $k$ was chosen at random.)
- 209
7
votes
1
answer
8k
views
Obtaining the key length of a columnar transposition, given a known plaintext word
I'm revising for a cryptography exam at the moment and I'm having some problems with a question.
The question looks for the key length of a cipher given that the word "earthquake" appears in the ...
- 73
5
votes
2
answers
30k
views
How to find the keyword of the Playfair cipher, given the plaintext and the ciphertext?
I know how the Playfair cipher works. I would like to know how to find the keyword of the Playfair cipher, given some ciphertext and the corresponding plaintext.
For example:
encrypted: ...
- 145
5
votes
2
answers
13k
views
RC4 , Is it possible to find the key if we know the plaintext and ciphertext?
Is it possible to find the key if we know the plaintext and ciphertext with RC4. How should I write the algorithm?
- 85
5
votes
1
answer
202
views
Could a strong round function be immune to slide attacks
An excerpt from the wikipedia article on slide attacks states:
...The only requirements for a slide attack to work on a cipher is that it can be broken down into multiple rounds of an identical F ...
- 19.5k
4
votes
2
answers
5k
views
Do known-plaintext attacks exist for public key encryption?
In asymmetric ciphers we publish the public key for anyone, which means an attacker can encrypt any message they want and compare the ciphertext and plaintext without communicating with the owner of ...
- 49
4
votes
1
answer
4k
views
Attack on DSA with signatures made with k, k+1, k+2
For homework, I'm asked to find the private key, $x$, in a DSA digital signature scheme. In the particular instance, we are given the parameters $p$, $q$ and $g$, the public key $g^x$, 3 messages $(...
- 449
4
votes
2
answers
2k
views
Determine AES key given encrypted and unencrypted files
Given an encrypted file, the original unencrypted (cleartext) file, and knowledge of which AES encryption algorithm was used, is it possible to determine the key that was used to encrypt the data in a ...
- 143
3
votes
2
answers
2k
views
How to defend AES against chosen-plaintext attack?
I have a server which encrypts files with the same AES key. Users can upload a file and download its encrypted version. A user can upload as many files as he wants. Users can decrypt the documents via ...
- 141
3
votes
1
answer
747
views
AES with a different implementation of byte substitution step
I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me:
suggested a new implementation for AES:
The byte substitution step will be ...
- 31
3
votes
1
answer
510
views
How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?
If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:
...
- 1,000
2
votes
1
answer
2k
views
AES-CBC ciphertext manipulation with known IV and plaintext! [duplicate]
I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin"...
- 23
1
vote
2
answers
6k
views
Brute force, get AES keys by multiple plain-texts with their cipher-texts
I know that the encryption is AES, and I have multiple plain-texts with their cipher-texts, I don't know the encryption mode (ECB, CFB, etc ...) actually, but I know that the keys and the IV Key (if ...
- 15
1
vote
2
answers
490
views
Looking for encryption algorithm not subject to known-plaintext attack with IV reuse
I've encountered an interesting problem where we can basically say the following:
We need to encrypt messages, but we have no room to store IVs. We can synthesize IVs; however an attacker would be ...
- 441
8
votes
3
answers
4k
views
Encrypting files with known headers
If I encrypt a file of a known format that has a lengthy header (e.g. an XML Excel file), does that render the encrypted file susceptible to a "known plain text" attack? In other words, if the first ...
- 233
7
votes
1
answer
3k
views
Does the Biclique attack on AES pose a credible risk to its security?
I have heard a lot about the biclique cryptanalysis research on AES, which as far as I know is the closest anyone has got to breaking AES.
Exactly how close did they get? Does this attack propose a ...
- 1,727
6
votes
1
answer
298
views
On CPA & KPA security of $\boxplus$-Feistel
I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given:
$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a ...
- 2,074
6
votes
2
answers
2k
views
RSA Signature Weak Padding Attack
Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
- 105
6
votes
2
answers
2k
views
Does having a known plaintext prefix weaken AES256? [duplicate]
I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext. ('Hello World!' for example.)
Does having this known plaintext prefix weaken AES256?
I do not care ...
- 71
6
votes
2
answers
356
views
What were Alan Turing and their team searching before doing KPA in the movie "The imitation game"?
I just watched the movie "The imitation game" (2014) which is based on Alan Turing's biography.
At some point in the movie the machine built by Turing wasn't fast enough to decrypt the ...
- 163
5
votes
2
answers
554
views
Affine plaintext attack with GCD != 1
I'm trying to crack an affine cipher, but when cracking I cannot find the inverse of a number because the GCD is not 1. This is my plaintext and this is my ciphertext:
...
5
votes
1
answer
561
views
Do all ciphers have equivalent decryption keys?
Do all ciphers suffer from the problem of multiple equivalent decryption keys? Is the existence of equivalent keys an essential property for the security of a cipher?
If you could prove that a cipher ...
user9070
4
votes
1
answer
4k
views
Known Plaintext Attack on Block Cipher in ECB and CBC Modes of Operations
These 2 similar questions are from Paar's Understanding Cryptography. I could not see the answer so if someone can help I will appreciate:
Question1: We consider known plaintext attacks on block ...
- 869
3
votes
2
answers
2k
views
Is symmetric encryption vulnerable to plain-text-attacks?
Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
- 31
3
votes
2
answers
582
views
Getting the encryption method and key from the encrypted data and the raw data
I have some pairs of plaintext and ciphertext data, from which I need to be able to decrypt the other passwords stored in the database.
The password field typically contains something like
...
- 133
1
vote
1
answer
10k
views
Affine cipher: calculate the key from a known plaintext/ciphertext pair
Suppose I have a ciphertext that I know is encrypted using an affine cipher in $\mathbb{Z}_{26}$. The plaintext begins with es and the corresponding ciphertext is <...
- 15
1
vote
1
answer
853
views
KPA on Feistel cipher?
I heard that DES is technically “broken” because of attacks involving large amounts of known plaintext. These attacks are obviously academic and highly complicated, so for some intuition I was hoping ...
- 11
1
vote
2
answers
202
views
Multiple XML files and known-plaintext attack
I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
- 13