Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If Bob sends some plaintext to Alice for encryption before sending the ciphertext to Carol, can Bob deduce the key by comparing the plaintext and ciphertext assuming only Alice and Carol knows the key and it is a symmetric encryption scheme?

share|improve this question
Edited the question to make it clearer, but i would think its a better fit for crypto stackexchange. – Terry Chia Jun 18 '12 at 10:45

It sounds like you're describing a "chosen plaintext attack" where Bob can craft a series of special messages that he can use to break the encryption through differential cryptanalysis.

(You might also be thinking of the "known plaintext attack" where Bob knows the plaintext and the ciphertext but can't make special ones - e.g. if Alice is reading the plain texts then she might notice Bob is sending weird messages.)

(And as a0video points out, there are also attacks where the attacker can encrypt the same plain text with different keys.)

Some symmetric encryption algorithms are indeed vulnerable to these attacks.

On a practical note, though, if you are properly using a modern, well established symmetric algorithm, such as AES - and you should be! - then you have little to worry about. The best crypto attacks on AES still don't reduce the time needed to break them to anything remotely do-able.

share|improve this answer

It depends on what construction you are using. For example Graham mentioned AES, which its known to be a semantic secure block cipher. However, all ciphers are vulnerable to exhaustive search attack and in the case of AES, even four times better key recovery attack is known - this paper from BKR '11

share|improve this answer
Ah, good point, if the attacker is able to encrypt the same plaintext with keys they choose, they can do more. I'll update my answer. – Graham Hill Jun 18 '12 at 13:56

This kind of attack would work no problem if the key is not strong. So the weak key, the known plain text does help a lot. I mean, with AES and truly random key the known plain text would not help.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.