The plain text and the cipher text have a one to one mapping. Given a pair of those, can there be multiple keys used to generate the same pair? Or can a particular plain text - cipher text mapping be achieved through only a particular key?


1 Answer 1


As is often the case, the answer is it depends.

In ECB mode, a single plaintext and key combination results in exactly one ciphertext output, and a single ciphertext and key combination results in exactly one plaintext output. This is a requirement for the encryption and decryption process: it must be reversible, otherwise it is rather pointless (then you'd be looking at some form of hash function).

If different keys could generate the same ciphertext from the same plaintext, then what would cause one ciphertext and not some other to be generated? There is no random number generator involved in DES (although you'd hope there is one in key generation).

If different plaintexts could generate the same ciphertext given the same key, then how would decryption determine which plaintext is identical to the originally encrypted plaintext?

It follows from this line of reasoning that in ECB mode, the same pair of plaintext and ciphertext must map to exactly one key.

Of course, nobody in their right mind uses ECB mode as anything more than a building block for something more robust. However, as pointed out by Mark, your question doesn't make a lot of sense in modes other than ECB.

Modes other than ECB, such as CBC (Cipher Block Chaining), CTR (Counter), CFB (Cipher Feedback) and so on feed something more than the plaintext/ciphertext and key into the encryption/decryption function. These are normally initialized with some form of what is known as an Initialization Vector (abbreviated IV) or nonce (for "number used only once"). The IV simply randomizes the process.

In these cases, when working with a single block of plaintext data, you can expect for any combination of plaintext and key any ciphertext value to be possible, with the IV essentially functioning as a selector. The next block is processed similarly but with something about the previous block taking the place of the IV. The IV is normally not considered a secret; its purpose is not to protect the plaintext, but rather to force an attacker to use an attack mode that cannot be reduced to effectively a table lookup as can be done with ECB (a very large table, but still a table lookup). Using a feedback mode of some sort also ensures that patterns in the plaintext do not appear as patterns in the ciphertext.

  • That's not the question that was asked. The question was essentially "given a plaintext/cyphertext pair, is there more than one key that could have produced the pair?", which is really only a meaningful question in ECB mode.
    – Mark
    Sep 28, 2014 at 22:15
  • @Mark Fair enough point. How about now?
    – user
    Sep 29, 2014 at 7:19
  • @MichaelKjörling By saying : "If different keys could generate the same ciphertext from the same plaintext, then what would cause one ciphertext and not some other to be generated?", you mean that it's not possible to have multiple keys for a given plaintext/cyphertext pair ? Feb 29, 2016 at 20:28
  • @MehranTorki I suppose it would be possible to design a cipher that has such a property, but it seems to me like it would just be another portion of the key, and DES certainly has no provisions for anything like that.
    – user
    Mar 1, 2016 at 9:00
  • @MichaelKjörling In terms of probability, i think that's possible in DES! read this text file if you have time: class.coursera.org/crypto-preview/lecture/… Mar 1, 2016 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .