Re: [Cfrg] Encrypting a known short text

[Natanael <[e-mail]>]

Den 22 sep. 2017 18:20 skrev "Erik Andersen" <[e-mail]>:

Suppose we have a protocol, where everything is encrypted.

If the clear (short) text may be guessed by an attacker (it could be an
ASN.1 NULL), do we then have a security issue, where the encryption key
could be revealed?

For modern ciphers and ciphermodes, the private key is never at risk even
if both the plaintext message, the ciphertext and any nonce/IV are known.
They resist known plaintext attacks.

At best the adversary could use sidechannel leakage, metadata and size
correlation to make a guess, but without the secret key or another form of
verifier (like a hash of the plaintext, or similar derived data) they can't
confirm it.

For some contexts it may be a risk, like for "convergent encryption" in
which the encryption key is deterministicly determined from the plaintext,
for the purpose of deduplication in encrypted file storage. This is part of
the security model of such systems, but the users may not always be fully
aware that somebody can guess what files they have stored if the adversary
have a full identical copy of the plaintext or can guess it.
This would for example apply to leaked documents or honeypot documents
being possible to detect if unmodified, where your file list could be
compared against known files.
But if you're a bunch of people using it to store your non-sensitive media
collections, then there's no problem with it.

For comparison, regular encryption have full resistance to known plaintext
attacks. They also have ciphertext indistinguishability (the adversary
can't tell which ciphertext came from which plaintext message, even if you
know the full messages).

Convergent encryption also resists known plaintext attacks in the classic
definition (except for when the full exact message is known, wherein you
can derive the key directly), but the scheme fails completely on ciphertext
indistinguishability (you can always tell *what it isn't*, and sometimes
also tell what it is).