5 ms·
Ask HN: How do computers 'know' when they've used the right encryption key?
Probably a newb question, but security & encryption really interest me.
In this example say I encrypt the word "Coffee" and after encrypting it I send it through cyberspace as "37fbFFJKEBF79fdgueG"
So if a malicious attacker tries to crack this by pure brute force, each time they use the 'wrong' key they still get a value back - correct? So if they use the wrong key they will continue to get gibberish until they use the correct key and get the word "Coffee"
My question is, how does the hacker (or the computer) know when they've guessed correctly and differentiate between the gibberish & the real data? Does the data return an 'error' if you try to crack it using the wrong key? If not, how do they know when they have guessed correctly and cracked it?
- dozzie 11y agoIn the real world, an attacker knows some plaintext of the message, or at least its format. For instance, it would be an IP or TCP header, HTTP request, or PNG/JPEG format header.
- jc_811 11y agoSo if this were happening with brute force, the attacker would keep using different keys until the data returned was clearly an IP address? (or whatever else they are looking for). And the computer doesn't actually know or get any feedback if it's correct? It's all on the attacker to analyze the results of each attempt
- dozzie 11y ago> until the data returned was clearly an IP address? No. Any four bytes is an IP address. You do realize that IP is a protocol, right?
- deleted 11y ago[deleted]
- jc_811 11y agoSorry misspoke there. I meant to simply sub in one of the examples you had given (IP or TCP header, HTTP request, or PNG/JPEG format header)
- dozzie 11y agoAh, it was my fault then. Sorry. I had a header of an IP packet in mind. Its format is known and machine-verifiable, and even includes a simple checksum, so it's quite easy to tell if the guessed encryption key has a chance of being valid.
- tantalor 11y agoAn analogy for plain text (such as a telegram) might be looking for common words, e.g., "the", "be", "to", "of", ... https://en.wikipedia.org/wiki/Most_common_words_in_English https://en.wikipedia.org/wiki/Most_common_words_in_English
- tptacek 11y agoThis is a good question that can get a little deep. The short answer depends on what you're cracking. Let's assume your message was encrypted with AES, using a key derived from a passphrase, and nothing else. There's no authenticator on the message (no keyed checksum) and so the ciphertext is insecure, but we'll ignore that. Then the attacker is just going to try every possible password. As you observed, each of those decryption attempts is going to generate gibberish. But all those gibberish results will be binary gibberish: a decryption attempt with a key differing even in one bit from the real key will produce an effectively random plaintext, with bits evenly distributed. The right key won't have that property; the result will be 7-bit ASCII. It will almost certainly be the only result that produces ASCII, and certainly the only one producing intelligible ASCII. :) If the message is encrypted securely, with an authenticator, the job of cracking it might be slightly simpler: you use the authenticator to verify that you got the right result. This is how some older systems tell you you got the right key (but it also implies that you encrypted the MAC, which is unsafe for other reasons). Finally, if you're encrypting with a block cipher mode that requires padding --- something you shouldn't do but that systems designed 5+ years ago all tend to do --- you'll know if you got the right key based on whether the padding makes sense. There's a very famous crypto attack based on this property. http://cryptopals.com/sets/3/challenges/17/ http://cryptopals.com/sets/3/challenges/17/
- jc_811 11y agoThis was a super helpful answer, thanks!
- jonny_storm 11y agoWhen working with a low-level cryptography API for the first time, you can easily miss a step and subsequently mistake ciphertext for plaintext. Unless the length or contents of the result fails to match your expectations, you'll have no way to know otherwise. Indeed, the notion of what expectations you can even have of the data, in principle, relates to information theory and reducing said expectations is crucial to keeping private transmissions secure.