Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

Question

I am a newbie in the security field, so sorry for the naive question.

In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret pretty easy?

As a prephase:

I am implementing initial security for my small casino, and consider using SSL channel for client - server interactions during the game. What stops me is that I am going to support game observers, who will only track the game state. So if observer becomes attacker, he will effectively know encrypted message, original message and encryption algorithm, effectively leaving nothing out of SSL security.

Answer 1

No, it is not true.

Being able to recover the key, while knowing the original message (the "plaintext") and the encrypted message (the "ciphertext") and the algorithm, is called a known plaintext attack. If the attacker not only knows the plaintext and the ciphertext, but actually gets to choose either, then this becomes a Chosen-Plaintext Attack or a Chosen-Ciphertext Attack. Good encryption algorithms are supposed to resist such things; meaning that if a known/chosen plaintext/ciphertext attack applies, even if it requires ludicrous amounts of known plaintext (e.g. some trillions of terabytes), then this counts as a "break" and the algorithm is said to be "weak" or "broken", at least in an academic way.

We have several encryption algorithms (e.g. the AES) for which no such attack is known, and that's not for lack of searching for such attacks. So these algorithms are deemed "secure".

Answer 2

No, actually not, the reason is that the secret key is not used to encrypt the traffic. The secret key is first used by the end points to authenticate each other, then it is used in a process (along with random data) to generate the encryption keys. So if you know the plaintext and the ciphertext you could discover the encryption key, but the secret would remain unknown.

Once you know the encryption key you could then work on getting the secret, however that's going to be more difficult as you have nothing known to work with.