Cryptoanalytic Attacks

Susan Landau, Sun Microsystems

Cryptoanalytic attacks fall into five general categories:

1.

Ciphertext-only attack. The cryptanalyst has the ciphertext of a message that has been encrypted using the algorithm.

Given: C₁=E_k(P₁), C₂=E_k(P₂), ..., C_i=E_k(P_i).

Deduce: P₁, P₂, ..., P_i or P_i+1 from E_k(P_i+1).

2.

Known-plaintext attack. The cryptanalyst not only has access to the ciphertext of a message but also its plaintext.

Given: P₁, C₁=E_k(P₁), P₂, C₂=E_k(P₂), ..., P_i, C_i=E_k(P_i).

Deduce: k or an algorithm to determine P_i+1 from E_k(P_i+1).

3.

Chosen-plaintext attack. The cryptanalyst chooses the plaintext to encrypt.

Given: P₁, C₁=E_k(P₁), P₂, C₂=E_k(P₂), ..., P_i, C_i=E_k(P_i), where the cryptanalyst chooses P₁, P₂, ..., P_i.

Deduce: k or an algorithm to determine P_i+1 from E_k(P_i+1).

4.

Adaptive chosen-plaintext. A variation on the above, where the chosen plaintext P_j+1 is based on previous information gained from C₁, ..., C_j.

5.

Chosen-ciphertext attack. Cryptanalyst chooses a ciphertext to be decrypted, while having access to the decrypted plaintext.

Given: C₁, P₁=D_k(C₁), C₂, P₂=D_k(C₂), ..., C_i, P_i=D_k(C_i).

Deduce: k or an algorithm to determine P_i+1 from E_k(P_i+1).

[Note from JBH: in these descriptions P_j are plaintext messages, C_j are ciphertext messages, k is the key, E_k is the encryption algorithm (or method) using k, and D_k is the corresponding decryption algorithm. The descriptions need to be modified slightly for a public-key, rather than symmetric, system.]

About this document ...

Cryptoanalytic Attacks

This document was generated using the LaTeX2HTML translator Version 97.1 (release) (July 13th, 1997)

Copyright © 1993, 1994, 1995, 1996, 1997, Nikos Drakos, Computer Based Learning Unit, University of Leeds.

The command line arguments were:
latex2html -link 0 -split +0 attacks.

The translation was initiated by Joshua Holden on 9/14/2000