Let's say an attacker knows the encrypted content, the decrypted content and the algorithm used: can he get the key that was used to encrypt the content or does it make it easier to find the key out?
I think that this may vary between symmetric and asymmetric encryption and between different algorithms. So how secure is this scenario with different algorithms if the only thing I need to keep secret is the key?
I ask this question because I just read through the SpiderOak FAQ and as far as I understood that, they are neither storing a user's password nor the encryption key which is derivered from the user's password. However, they need to make sure that the user's password is the right one when he's logging in to the web page.
If they don't store the password and don't store the key, the only possibility to check whether the password is right is to decrypt some known encrypted data and check whether the result is the right one.
E.g. when registering they might encrypt the data
CHECK and when logging in they might derive a key from the entered password and decrypt the encrypted
CHECK and see whether it is
CHECK. If not, the key was not right, and thus the password wasn't either.
Is there any other way how they could do it?