Subject: [Cfrg] Encrypting a known short text

From: "Erik Andersen" <[email-masked]>
Date: Fri, 22 Sep 2017 18:19:49 +0200

Suppose we have a protocol, where everything is encrypted.

If the clear (short) text may be guessed by an attacker (it could be an
ASN.1 NULL), do we then have a security issue, where the encryption key
could be revealed? 

Best regard,

Erik

---

From: Greg Rose <[email-masked]>
Date: Fri, 22 Sep 2017 09:31:49 -0700

No. Availability of the plaintext to the attacker is a standard assumption.

Greg.

Phone/Signal:  +1 619 890 8236 
GPG/PGP:  1081A37C  232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C

> On Sep 22, 2017, at 9:19 , Erik Andersen <[email-masked]> wrote:
> 
> If the clear (short) text may be guessed by an attacker (it could be an ASN.1 NULL), do we then have a security issue, where the encryption key could be revealed? 
>  
> Best regard,
> Erik
>  
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Michael StJohns <[email-masked]>
Date: Fri, 22 Sep 2017 16:33:09 +0000

https://en.m.wikipedia.org/wiki/Known-plaintext_attack

---

From: Natanael <[email-masked]>
Date: Fri, 22 Sep 2017 18:57:27 +0200

Den 22 sep. 2017 18:20 skrev "Erik Andersen" <[email-masked]>:

For modern ciphers and ciphermodes, the private key is never at risk even
if both the plaintext message, the ciphertext and any nonce/IV are known.
They resist known plaintext attacks.

At best the adversary could use sidechannel leakage, metadata and size
correlation to make a guess, but without the secret key or another form of
verifier (like a hash of the plaintext, or similar derived data) they can't
confirm it.

For some contexts it may be a risk, like for "convergent encryption" in
which the encryption key is deterministicly determined from the plaintext,
for the purpose of deduplication in encrypted file storage. This is part of
the security model of such systems, but the users may not always be fully
aware that somebody can guess what files they have stored if the adversary
have a full identical copy of the plaintext or can guess it.
This would for example apply to leaked documents or honeypot documents
being possible to detect if unmodified, where your file list could be
compared against known files.
But if you're a bunch of people using it to store your non-sensitive media
collections, then there's no problem with it.

For comparison, regular encryption have full resistance to known plaintext
attacks. They also have ciphertext indistinguishability (the adversary
can't tell which ciphertext came from which plaintext message, even if you
know the full messages).

Convergent encryption also resists known plaintext attacks in the classic
definition (except for when the full exact message is known, wherein you
can derive the key directly), but the scheme fails completely on ciphertext
indistinguishability (you can always tell *what it isn't*, and sometimes
also tell what it is).