4 ms·
ECB with chosen-plaintext also allows you to decrypt whatever you want.
by stouset 12y ago
ECB with chosen-plaintext also allows you to decrypt whatever you want.
- tedunangst 12y agoDetails?
- tptacek 12y agoIt's one of our crypto challenges, and the conceptual basis for the BEAST attack.
- tedunangst 12y agoI believe I read a little too much into "decrypt anything."
- tptacek 12y agoWhat were you thinking they meant? (Just curious.)
- tedunangst 12y agoGuess and check (beast, as I understand it) requires some prior knowledge of the data format. I was imagining something that worked against entirely random data.
- tptacek 12y agoYes. You can do simple things to data to make the basic byte-at-a-time attack hard to conduct. But a comparable amount of effort takes you to strong authenticated encryption. Virtually all systems that use ECB and have attacker-influenced plaintext are susceptible to the attack we're talking about.
- pbsd 12y agoNot exactly chosen-plaintext; pedantically speaking it's blockwise-adaptive chosen plaintext. The distinction is important because provable resistance to regular chosen plaintext attacks (i.e., IND-CPA) is part of what kept broken modes around for so long---they're 'provably secure'!