3 ms·
"At first glance, this seems fine, but it is not. If an attacker knows the plaintext p1 and the ciphertext c1, then they can compute the keystream by XORing p1
by WantonQuantum 2y ago
"At first glance, this seems fine, but it is not. If an attacker knows the plaintext p1 and the ciphertext c1, then they can compute the keystream by XORing p1 and c1 together"
Also, if the attacker only has c1 and c2, if the nonce is reused then c1 xor c2 will be the same as p1 xor p2. In most cases, two plaintexts xored with each other are trivial to decode.
- Raed667 2y agoI made an entire "game" based on this concept (AES CTR though) https://aes-cpa.fly.dev/ https://aes-cpa.fly.dev/
- hifromwork 2y agoFor anyone interested, I made a few more: * https://ctr.var.tailcall.net/ https://ctr.var.tailcall.net/ * https://ecb.var.tailcall.net/ https://ecb.var.tailcall.net/ * https://cbc.var.tailcall.net/ https://cbc.var.tailcall.net/ The goal is a bit different (I use them when teaching university courses, to show that encryption is not authentication), but the same ideas apply.