# Tag Info

## Hot answers tagged known-plaintext-attack

29

These aren't "attacks" in and of themselves, they are simply a way to classify attacks depending on how many assumptions they make. For instance, if an attack requires plaintext-ciphertext pairs to recover the key, but they don't have to be any particular pairs, that attack is categorized as a known-plaintext attack. However if another attack required the ...

23

if a cipher has a known-plaintext attack, then it is considered completely broken. Yes, pretty much... [Paraphrased] But can't we come up with a case where this isn't true, such as a One Time Pad? Yes, we can come up with cases like that; however the requirements of such a case (key as long as the plaintext, no key reuse) make such a cipher impractical. ...

22

(Notation. Sets are represented using the calligraphic font and algorithms using the straight font. Throughout, $\Sigma:=(\mathsf{K},\mathsf{S},\mathsf{V})$ denotes a signature scheme on a key-space $\mathcal{K}$, message-space $\mathcal{M}$ and signature-space $\mathcal{S}$. Since only a single key-pair is involved in the discussion, to avoid cluttering, ...

16

If the user changes the key for every message sent, then what use is a known-plaintext attack? Stop right there. This is not what we are trying to prove when conducting a known-plaintext attack. A known-plaintext attack is one where we are given a bunch of ciphertexts, all stemming from encryption using a fixed key. We are then given one plaintext/...

15

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more ...

11

No matter how bad a protocol built on top of RSA is, there is no known risk that a private key leaks from valid plaintext/ciphertext pairs, even if the adversary chooses plaintext or ciphertext; that's one of RSA's virtues. Thus to the question is it possible with this information for Cindy to find $pri_A$ we can answer: as far as we know, no; and more, ...

11

AES-256 has sustained 15 years of cryptanalysis, and it can be stated that no knowledge of some plaintext bytes would help to reveal the other bytes no matter what mode of operation (CBC, CTR, etc.) is used. AES-GCM is an authenticated encryption scheme that allows a key holder to detect any modification that has been done to the ciphertext. If you do not ...

11

When using CTR Mode the AES is used to generate a kind of key stream which itself is the XORed to your plaintext. So AES is actually encrypting an incrementing counter. At the moment there is no known attack, that would yield E(N) if you do know E(N-1), where N is the aforementioned counter. So this should be safe. But be aware, as the plaintext is XORed ...

11

No, padding would make the message much easier to crack. This is a great example of why cryptography is left to the professionals (I am not a professional cryptographer, I'm not even a very good amateur one). Amateurs tend to just make things worse. First problem is the Enigma had no way to produce a "null". It was only capable of producing letters. The ...

10

I will start with all relevant references I found, then tentatively answers the question. Feel free to improve this community wiki. It was originally asked the effort to break PKZIP 2 encryption, described in section 6.1 of the .ZIP File Format Specification (with some refinements in the derived Info-ZIP appnote), assuming a high-entropy password (that is, ...

10

No, to the best of our knowledge, it is not possible, apart from a brute force search over all possible keys. RC4 has known cryptographical weaknesses; however, none of them are of much help in recovering the key, given a plaintext/ciphertext pair. There are backtracking approaches that might take circa $2^{700}$ effort independent of the key size; however ...

10

Do all ciphers suffer from the problem of multiple equivalent decryption keys? No. The number of non-equivalent keys is bounded by the number of permutations. Since the number of permutations is very high there is a very big chance that ciphers do not have equivalent keys. This is especially true for ciphers with a high block size (AES with 128 bits). Even ...

10

What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^{128}$ AES operations, today's top computers can reach $2^{63}$ around one hour. However, reaching $2^{128}$ is beyond classical ...

9

Efficiently - no. However, the best attack on DES - linear cryptanalysis - works with known plaintexts, and theoretically may work slightly faster than the brute force even for small amounts of data. Computing linear relations between plaintext $P$ and ciphertext $C$, an attacker is able to enumerate all keys according to their likelihood. The PhD thesis by ...

9

Yes. Remember that, in a Vigenère cipher, the $n$-th ciphertext letter is calculated by adding the $n$-th plaintext letter and the $n$-th key letter (where the key is repeated as many times as necessary to make it as long as the plaintext) modulo 26 (for the standard English alphabet), i.e.: $$c_n \equiv p_n + k_n \mod 26 \tag1$$ (Here, I'll assume the ...

9

For a meet-in-the-middle attack with known plaintext, you break all $K_i$ at the same time. The goal is to split the work into multiple sides, trading off some exponential work for some exponential space and some linear work. Split the encryption and decryption sides evenly. You need $(2^8)^4 \times 2 = 2^{33}$ block cipher calls, because you need 4 layers ...

7

Could the attacker figure out the AES key if the IV used to encrypt all the strings is the same? No; the AES key is secure against such an attack. Could the attacker figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known? No, the AES key is secure against such an attack. You say that you are ...

7

If a popular encryption scheme is being used: No. The typical solution is that symmetric stream/block ciphers generate a constant stream of new pseudo-random bits which are merged/XOR'd with the plaintext to produce the ciphertext. The pseudo-random stream is seeded indirectly by the private key - so as long as the previous or future bits of the PRNG can ...

7

You got three equations with two unknowns ($k$ and $x$). You only need two signatures to solve the private key $x$: $s_1k \equiv h_1 + xr_1 \pmod q$ $s_2k + s_2 \equiv h_2 + xr_2 \pmod q$ This might be solved using Gaussian elimination. Step 1: $s_1k/r_1 \equiv h_1/r_1 + x \pmod q$ - Divide 0.1 by $r_1$ $s_2k + s_2 - s_1kr_2/r_1 \equiv h_2 - h_1r_2/r_1 \... 7 If you are using a modern, secure cipher, there is no reason whatsoever to perform such manipulations of the plaintext. I'm not sure how to elaborate much more on the topic than that. The entire purpose of a cipher is to perform the exact types of confusion and diffusion you describe. Only, the approach that it will use has been designed, peer-reviewed, and ... 7 I've thought quite a lot about this, and I think in general the answer is no, it would not be a good idea to use a KCV for those kind of situations. Using a hash or even better a MAC (using the key as MAC Key) would be a much better idea when a KCV is required. Instead of zero's, it would be much better to use a previously random (block of) bytes that is not ... 7 As Stephen already said in his answer, if you use a modern secure encryption scheme, then you do not have to worry about the confidentiality of the messages. However, as you say your application is a chat the following part of your question: if I add some extra bytes to the message seems to be a valid (although maybe "paranoid") issue. I interpret this ... 7 To a cryptographer, "signing a document is to encrypt its hash using signer's private key" is wrong, because: It is specific to RSA and cousin cryptosystems including Rabin, and not even remotely descriptive of other common signature schemes; It misses an important step, padding, which is different for RSA signature and RSA encryption. If we use no padding, ... 7 TLDR: The scheme is symmetric only, its "provable security" argument is flawed, and it is practically insecure when even a modest amount of plaintext is available to attackers. I'm commenting on the scheme in: Josep Domingo-Ferrer, A Provably Secure Additive and Multiplicative Privacy Homomorphism, published in proceedings of ISC 2002. I ignore the 1996 ... 6 If we note$|m|$the number of bits in the bytestring coding the message$m$, the first padding considered is$m\mapsto \tilde m=257\cdot2^{|m|}+m$, and the signature is$m\mapsto\tilde S(m)=S(\tilde m)=\tilde m^d\bmod N$, where$S$is the textbook/naked RSA signing$m\mapsto m^d\bmod N$. Notice that for any$m$small enough that$m^2$can be signed, we can ... 6 This answer has been updated a lot, again, after being accepted. I now base my analysis on simple functional equivalent source code to the deterministic PRNG used. The cryptosystem proposed works, in the sense that it allows decryption. The best cryptanalytic method there is to predict further output is enumerating the 64-bit key by brute force. That's in ... 6 Your parameters that you provide are incomplete (in what group are you working?). Anyways, lets assume that you work in$\mathbb{Z}_p^*$, your have a generator$g$and your public key is$y=g^x$. Then, if two ciphertexts share the same randomness$k$, they will look like$(c_1,c_2)=(g^k,m\cdot y^k)$and$(c_1',c_2')=(g^k,m'\cdot y^k)\$ for your two messages ...

6

First of all, you cannot uniquely determine the keyword of a Playfair cipher, or even the key table constructed from it, simply because there are multiple equivalent key tables that will produce the same ciphertext (and multiple keywords that will produce each table). In particular, the following key tables are all equivalent: Original: Row shift: ...

Only top voted, non community-wiki answers of a minimum length are eligible