2

I am playing with the windows cryptography functions and notice that the results for cryptencrypt produce similar ciphertext for similar plaintext. for example:

plaintext "100000" produces T\ãK„© or 84 92 227 75 132 169

plaintext "100001" produces T\ãK„¨ or 84 92 227 75 132 168

plaintext "100002" produces T\ãK„« or 84 92 227 75 132 171

Shouldn't encrypted data appear to be totally uncorrelated to the source data?

these are the parameters I'm using:

CryptAcquireContext   PROV_RSA_FULL
CryptCreateHash  CALG_MD5
CryptDeriveKey  CALG_RC4
Improve this question
0

2 Answers 2

Reset to default
5

RC4 is a stream cipher. If you're using the same key and IV, you will get ciphertext that looks very similar when the plaintext looks very similar. This is why IV reuse with stream ciphers is a really, really, bad thing.

Improve this answer
0

No, stream ciphers are designed to be able to decrypt as data is received, without waiting for the entire ciphertext, so if the beginning parts of the data are the same, then the corresponding ciphertext is the same.

However, changes in plaintext should cause cascading changes in the ciphertext. So if you continue your strings further (e.g. 100000123, 100001123, 100002123, etc.) then you should see differing ciphertext after the point of difference.

Improve this answer
4
  • 1
    That's not what I see when I try it , it looks like the ciphertext is the same after the point of difference
    – wayne-h
    Commented May 17, 2018 at 17:08
  • 1
    Some (not all) stream modes (of block ciphers) propagate, like CBC and CFB, but a stream cipher like RC4 does not.
    – dave_thompson_085
    Commented May 18, 2018 at 2:13
  • @dave_thompson_085 CBC is not a stream mode.
    – forest
    Commented May 18, 2018 at 9:00
  • @forest: you're right. oops.
    – dave_thompson_085
    Commented May 19, 2018 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .