If I know that Data A is an encrypted form of Data B is that sufficient information to determine the private key?

  • 2
    Presumably you mean, possible to do it faster than brute force checking of the key space? – Steve Jessop Apr 28 '14 at 15:20
  • 2
    Consider: I could make up my own B, and encrypt it with my target's public key to get A. (Key word being public -- these keys are supposed to be sharable with the world.) Were that enough info on its own to recover a private key, public key crypto would be worthless. – cHao Apr 28 '14 at 21:25

If the key can be recovered from knowing both a plaintext and the corresponding ciphertext, then this is called a known plaintext attack; an extension is the chosen plaintext attack where the attacker not only knows the plaintext, but gets to choose it. If a cryptographic algorithm is subject to CPA, then it is considered weak and broken. Thus, a secure encryption algorithm MUST resist CPA (and therefore KPA too).

Note that with asymmetric encryption (RSA), since the public key is public, everybody can create millions of plaintext/ciphertext pairs. This illustrates that an asymmetric encryption algorithm could never have been considered secure if it was broken through CPA. Conversely, it was long assumed that with symmetric encryption, the CPA model was not scary, because the attacker cannot encrypt data of his own without knowing the key; practice proved that theory to be wrong (in the case of HTTPS, evil Javascript or even plain HTML can make your browser issue requests with contents at least partially chosen by the attacker).

  • Doesn't Neal Stephenson include a CPA attack of Enigma in Cryptonomicon? Something along the lines of creating a crib, by causing a particular event to happen such that the message(s) reporting that event are partly predictable? I don't know whether any non-fictional operation of that kind was ever carried out or even considered, but it's clear why CPA should be considered dangerous for symmetric encryption in general. I suppose you could work around it by encrypting your message first with a random nonce, then with the symmetric key. – Steve Jessop Apr 28 '14 at 15:18
  • 3
    Yes, there is a very definite example of CPA in historical practice: it was in the prelude to the 1942 Battle of Midway. US forged a fake message about a broken water purifier, to see it encrypted into Japanese communications, and observe the encrypted result (where the Midway island was known as "AF" and they wanted to confirm that "AF" was indeed Midway). – Thomas Pornin Apr 28 '14 at 15:24
  • 1
    Excellent, although since the real cipher was already broken, in fact the code broken by CPA was the substitution cipher "Midway" -> "AF". Not the most sophisticated cipher broken during the course of the war... – Steve Jessop Apr 28 '14 at 15:27

For most modern encryption algorithms in use (e.g. RSA, AES), no.

Some algorithms would leak the key (e.g. if Data B is encrypted by XORing it with a one-time pad of equal length to the data, XORing Data A and Data B would give you the entire key), but they're not often deployed.

  • Thankfully, this is the case, or public/private key cryptography would be broken. In such a case, anyone sending a message could read all other messages. In the case of the one-time-pad, only a few people are given the key in the first place, so it's not an issue. – Clockwork-Muse Apr 28 '14 at 7:29
  • 4
    If the pad is truly a one-time pad, it doesn't matter if it is leaked to the same persone who already have both cleartext and cyphertext: the most important thing about one time pads is that they should never be reused. – Stephane Apr 28 '14 at 7:58
  • 2
    @Stephane Right. The idea with a one-time pad, is that since it's used only one time, there is only a single plaintext/ciphertext pair. So by definition if you have that pair, you already have everything you need. – Cruncher Apr 28 '14 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.