Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am a newbie in the security field, so sorry for the naive question.

In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret pretty easy?

As a prephase:

I am implementing initial security for my small casino, and consider using SSL channel for client - server interactions during the game. What stops me is that I am going to support game observers, who will only track the game state. So if observer becomes attacker, he will effectively know encrypted message, original message and encryption algorithm, effectively leaving nothing out of SSL security.

share|improve this question
    
Possible duplicate of Compute the AES-encryption key given the plaintext and its ciphertext? (The question is AES-specific, but the answers are generally sufficient to answer this generally-scoped question.) –  apsillers Oct 2 '13 at 20:06
add comment

2 Answers

up vote 10 down vote accepted

No, it is not true.

Being able to recover the key, while knowing the original message (the "plaintext") and the encrypted message (the "ciphertext") and the algorithm, is called a known plaintext attack. If the attacker not only knows the plaintext and the ciphertext, but actually gets to choose either, then this becomes a Chosen-Plaintext Attack or a Chosen-Ciphertext Attack. Good encryption algorithms are supposed to resist such things; meaning that if a known/chosen plaintext/ciphertext attack applies, even if it requires ludicrous amounts of known plaintext (e.g. some trillions of terabytes), then this counts as a "break" and the algorithm is said to be "weak" or "broken", at least in an academic way.

We have several encryption algorithms (e.g. the AES) for which no such attack is known, and that's not for lack of searching for such attacks. So these algorithms are deemed "secure".

share|improve this answer
add comment

No, actually not, the reason is that the secret key is not used to encrypt the traffic. The secret key is first used by the end points to authenticate each other, then it is used in a process (along with random data) to generate the encryption keys. So if you know the plaintext and the ciphertext you could discover the encryption key, but the secret would remain unknown.

Once you know the encryption key you could then work on getting the secret, however that's going to be more difficult as you have nothing known to work with.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.