Questions tagged [known-plaintext-attack]
The attacker knows at least one sample of both the plain text and the cipher text.
199
questions
3
votes
1
answer
249
views
Why is the Domingo-Ferrer cryptosystem not used in practice?
The Domingo-Ferrer cryptosystem is a fully homomorphic cryptosystem. It works fast enough. I have only seen known-plaintext attacks. Is this a reason not to use it in practice? Or are there more ...
- 33
2
votes
0
answers
90
views
Known-plaintext attack against E0 with 2745 bits per frame instead of 24
In the paper The Conditional Correlation Attack: A Practical Attack on Bluetooth Encryption, an attack against the E0 cipher is described which can break it efficiently in a known-plaintext attack:
...
- 15.1k
1
vote
1
answer
104
views
Cipher recommendation for known-plaintext attack
I need to encrypt a 4-digit number. The cipher-text can be up to 11 digits long and there are no limits for the key size.
Considering that the attacker has access to both the cipher-text and the ...
- 13
2
votes
1
answer
570
views
How many required known plaintexts for an attack are considered insecure?
I stumbled over this problem when looking at symmetrical block ciphers with a relatively small block size like 32 bit.
When I was looking at more common block ciphers with a 64 bit, I learned that ...
- 123
2
votes
1
answer
4k
views
Hill cipher: How to find an unknown key of unknown size
How would you tackle the problem of finding the key (you don't know the length) to a Hill cipher when knowing only one 12-letter word of plaintext and its corresponding ciphertext?
CONVERSATION has ...
0
votes
0
answers
75
views
Unique numbers with $P^aQ^bR^c \mod N$ for each combination of $a,b,c$ possible? Would it be safer than separate form (like $T^a \mod P$ for each)?
Main question: Is the computation of $a,b,c$ in $P^aQ^bR^c \mod N$ (much) harder than in $T_p^a \mod P$, $T_q^b \mod Q$, $T_r^c \mod R$ ?
(assuming the first form exists)
$P^aQ^bR^c \mod N$
With $P^...
- 573
0
votes
1
answer
52
views
How much more secure is $c = mg_1^r + g_2(g_1(g_1^r-1)/(g_1-1)) \mod p$ compared to just $c = mg_1^r \mod p$ (dis. log), all known but $r$?
To encode a message $m$ to a cipher $c$ you can use the only hard solvable problem of computing the discrete logarithm with a generator $g$ in base over a prime $p$.
$c = mg_1^r$ mod p
If an ...
- 573
1
vote
1
answer
374
views
IV Re-use and Chosen Plaintext against 56bit Blowfish (CBC)
I am looking at a very old protocol which uses Blowfish to encrypt packets with a constant 8-byte IV in CBC mode.
Assuming I have:
The ability to arbitrary encrypt known plaintexts
The IV
I know ...
- 111
0
votes
1
answer
963
views
how to compute IV with AES CTR if key, plaintext and ciphertext are known?
Given $E_k$, which a block-cipher using the (known) key $k$, and a plaintext-ciphertext pair $(p,c)$ where $c$ is the encryption of $p$ using CTR mode, can the initialization vector be recovered using ...
- 3
0
votes
0
answers
61
views
Is it necessary to study the KPA security for asymmetric encryption algorithms in addition to CPA security? [duplicate]
In a KPA attack model, an adversary $\mathcal{A}$ has access to pairs of messages $(m_i,c_i)$ which are encrypted using some asymmetric algorithm. However, assuming either El-Gamal or RSA algorithms, ...
- 113
1
vote
0
answers
621
views
show that G' is not a secure PRG even if G is
Hello I'm trying to show that the function G'(s) = G(s) || G(G(s)) is not a secure PRG even if G is.
My first question is that in this case, how do I know what G ...
- 111
2
votes
1
answer
2k
views
AES-CBC ciphertext manipulation with known IV and plaintext! [duplicate]
I'm currently practicing on a purposely flawed login page, where I have to change the value of a cookie to enter. The cookie is an encrypted and encoded form of a simple JSON string with fields "admin"...
- 23
2
votes
0
answers
101
views
Is my deniable encryption scheme reasonable?
I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
- 121
9
votes
3
answers
16k
views
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
If, how big does the list of plaintext ...
- 201
6
votes
1
answer
299
views
On CPA & KPA security of $\boxplus$-Feistel
I am interested to identify the effect of replacing $\oplus$ with $\boxplus$ on basic balanced Feistel structures over $r$-rounds. Given:
$F_\boxplus[L,R]= [S,T] = [R,L \boxplus f(R)]$ where $f$ is a ...
- 2,074
1
vote
1
answer
2k
views
Known Plaintext Attack for Modified OFB Mode of Operation
Question: Assume a variant of the OFB mode by which we only feedback the 8 most significant bits of the cipher output. We use AES and fill the remaining 120 input bits to the cipher with 0's:
Why is ...
- 869
4
votes
1
answer
4k
views
Known Plaintext Attack on Block Cipher in ECB and CBC Modes of Operations
These 2 similar questions are from Paar's Understanding Cryptography. I could not see the answer so if someone can help I will appreciate:
Question1: We consider known plaintext attacks on block ...
- 869
1
vote
1
answer
414
views
Ethereum RLPx protocol for inter-node communication - flaws in the encryption
Ethereum uses RLPx/devp2p for inter-node communication. The protocol is encrypted using Elliptic Curve Integrated Encryption Scheme (see ref)
Under Known-Issues I found this paragraph:
The RLPx ...
- 113
1
vote
1
answer
195
views
It's safe to store a known value (for checking) next to the actually encrypted values
The high level details of the encryption I'm using is:
AndroidKeyStore create/store RSA key
AES key is created and wrapped with RSA/ECB/PKCS1Padding
Encrypted AES is saved to disk.
Data is encrypted ...
- 133
2
votes
3
answers
1k
views
Known-plaintext attack on 1-round Feistel networks
Consider a simple, 1-round Feistel network.
Because the ciphertext is essentially $(L_1,R_1)$, if one knows the plaintext $(L_0,R_0)$, the only unknown left is $K$.
However round functions in ...
- 21
3
votes
1
answer
556
views
Is Paillier secure from known plaintext attack for single character message?
Assuming I have three messages m1,m2,m3 where m1=m2=m3=1 and I compute c1,c2 and c3.
Does that mean that c1=c2=c3 in cipher-text from ?
If not, how many times can I encrypt a message m=1 and still ...
- 55
1
vote
0
answers
32
views
Would it possible to decode an intelligible but alien message? [duplicate]
I've been reading some sci-fi and there is a frequent mention of decoding alien signals.
From what i read historically in ww2 for decoding enemy message the allies would transmit fake information ...
- 121
1
vote
1
answer
760
views
Clarification on Hill Cipher crib dragging technique
--- this has been edited as I realised the question was silly. replaced with helpful information ---
I want to confirm the following:
Given ciphertext "AGHTDIX... [cont.]" (C)
and crib (a word ...
user8339
4
votes
1
answer
323
views
Cracking truncated DES
Let's say we have a scheme in which 40 bits M are padded with 24 zeroes, encrypted using a secret DES key K, and the result truncated to the first 24 bits, C. If I wanted to determine a key that ...
- 143
3
votes
1
answer
1k
views
What's the difference between a known-plaintext attack and a ciphertext-only attack in terms of performance?
I know that in the KPA the attacker has access to both the plaintext and the ciphertext, but in the end it all comes down to performing an exhaustive key search. I'm not sure if having the ...
- 189
0
votes
1
answer
631
views
8th SharifCTF — What is the advisable way to recover the key of single round DES here?
I am participating in the 8th SharifCTF competition and have a related question:
I have 1000 plaintext and its ciphertext, which has been encrypted with DES algorithm (only 1 round).
Now, how can ...
- 148
2
votes
2
answers
184
views
If an attacker has a chosen-plaintext and encrypted data, can they determine the encryption type?
This question differs from How to determine what type of encoding/encryption has been used?, which asked about a ciphertext-only attack. This question is asking about a chosen-plaintext attack.
Let's ...
- 121
0
votes
2
answers
160
views
Reversability of Xor'd Values In Hash?
This may be a dumb question so please forgive me if so, but is a hash function considered one-way even if you have half of an xor'd value?
For example say I have the values R and C, both are randomly ...
- 549
1
vote
0
answers
67
views
Question on recovering a key in the algorithm
Let $E$ be a block cipher that has block size and key size both equal to 64 bits. Let $E'$ be a block cipher that has 64-bit block size and is defined as follows:
For a 128 bits key $K \mathbin\Vert ...
1
vote
2
answers
202
views
Multiple XML files and known-plaintext attack
I have created an app which collects data in sets which may contain up to 20000 XML files of an average size of about 5 KB, and all with the same header and XML structure, so that only the data they ...
- 13
2
votes
0
answers
147
views
Known Plaintext Attack A5/2
I am trying to understand the non-optimized known plaintext attack on A5/2 from Barkan, Bikan and Keller.
I don't understand the construction of the equation system:
$$S_{R4_1} * S_1 = k$$
Where $S$ ...
- 21
3
votes
2
answers
4k
views
Known plaintext attack without knowing the location of the plaintext
I'm trying to understand known plaintext attacks and since I best learn by doing I broke out Python and did the following:
I have a plaintext string s and a key <...
- 133
4
votes
2
answers
980
views
Why does DESX break if one removed post whitening?
DESX uses whitening to strengthen against brute force attacks. What is an attack one could use to recover DESX's pre-whitening key with only two known ciphertext/plaintext pairs, given that the ...
- 45
1
vote
0
answers
961
views
Known plaintext attack against Feistel ciphers
Assuming we have a Feistel cipher, with let's say 2 rounds i.e:
Plaintext $P=(L_{0},R_{0})$
$L_{1}=R_{0}$
$R_{1}=L_{0}\oplus f_{{K}_{1}}(R_{0})$
$L_{2}=R_{1}$
$R_{2}=L_{1}\oplus f_{{K}_{2}}(R_{1})...
- 111
1
vote
1
answer
71
views
While encrypting what can happen between words
From some time I am working with "pen and paper" encrypted text.
Keys are not known, algorithm is not known.
I managed to find simple algorithm and key that seems to be nearly perfect.
Nearly perfect ...
- 19
0
votes
1
answer
261
views
Whats the most secure way to encrypt a string without the use of a computer? [duplicate]
I want to decrease attack surface by preventing the plaintext string or encryption key from ever being typed or otherwise entered into a computer. Ideally the decryption key would be something that ...
- 111
3
votes
1
answer
7k
views
AES-ECB known ciphertext/plaintext attack
i'm new to crypto and am working on a little exercise to understand the weakness of ECB mode encryption. Here is the scenario.
I have the plain text
...
- 155
1
vote
1
answer
836
views
Is my XTEA encryption key safe if I publish my firmware both as plain text and encrypted?
I'm using this bootloader that implements XTEA encryption for uploading an encrypted firmware to small MCU:
https://github.com/nyholku/diolan-plus2
the actual XTEA code is here:
https://github.com/...
- 13
1
vote
2
answers
6k
views
Brute force, get AES keys by multiple plain-texts with their cipher-texts
I know that the encryption is AES, and I have multiple plain-texts with their cipher-texts, I don't know the encryption mode (ECB, CFB, etc ...) actually, but I know that the keys and the IV Key (if ...
- 15
-1
votes
1
answer
158
views
Preventing predictable modifications to AES encrypted data
I'm fairly new to cryptography and am trying to find out best practice for this situation. Let's say I have some code which is going to be used to pass around an encrypted e-mail address. I encrypt it ...
- 101
0
votes
2
answers
1k
views
Recover key given partial key, IV and cipher text using CBC mode
Given a known IV and a small part of the key (not enough to use brute force)
is there are any way to break CBC encryption with only one cipher text?
2
votes
2
answers
2k
views
AES-CBC-128 Known plain, IV, Cipher attack
Let's say we have a single char 'A' and we encrypted it as much times as we want with a fixed Key and a random IV
So now we have list of the IVs used, the result ciphers and ofc the known text "A"
...
- 21
0
votes
1
answer
20k
views
RC4, finding key if we know plain text and ciphertext [duplicate]
Having plain text A , and cipher text B. Can we somehow retrieve key , when we want to decrypt text C which was also crypted with the same key?
- 103
3
votes
1
answer
364
views
Security of a cryptosystem where the encryption is swapped with decryption
For any given one-key cipher $(M,C,K,E_k,D_k)$, we may modify it into $(M,C,K,D_k,E_k)$. In other words, we swap the encryption function with the decryption in the modified cipher.
Are the two ...
- 83
1
vote
0
answers
424
views
Encryption with both plaintext and ciphertext public
Does there exist a system wherein the encryption key/algorithm can be made indecipherable despite making arbitrarily many plaintext and ciphertext pairs available to the cracker? (Does this qualify as ...
- 141
32
votes
1
answer
9k
views
What do the signature security abbreviations like EUF-CMA mean?
From time to time, one stumbles across formal security definitions. This includes security definitions for signature schemes.
The most common ones are the *UF-* ...
- 45.7k
5
votes
2
answers
556
views
Affine plaintext attack with GCD != 1
I'm trying to crack an affine cipher, but when cracking I cannot find the inverse of a number because the GCD is not 1. This is my plaintext and this is my ciphertext:
...
1
vote
0
answers
343
views
Affine cipher finding the decryption map
Given two letters of the plaintext 'ZP' corresponding to the ciphertext 'AE' respectively, I have found the key to be (a,b)=(10,10) (modulo 26).
Therefore the decryption map $D(x)=a^{-1}(x-a)\bmod26$ ...
- 11
2
votes
1
answer
1k
views
Encrypting decimal values with AES
I have a column in a database table called "Amount" that will store decimal values encrypted with AES. It's highly likely that the same amount will exist in multiple rows in the table and be encrypted ...
- 47
4
votes
1
answer
10k
views
Hill's Cipher - Known Plaintext Attack
I know this question has already been asked few times but I'm struggling a bit on a problem.
I have a plaintext FRIDAY and its ciphertext PQCFKU, using $M = 2$, with corresponding integers $x = fr ...
- 143