Re: Countering chosen-plaintext attacks

From: Paul Pires (diodude_at_got.net)
Date: 03/09/04


Date: Tue, 09 Mar 2004 02:38:02 GMT


Mok-Kong Shen <mok-kong.shen@t-online.de> wrote in message news:c2ipc1$2jm$02$1@news.t-online.com...
>
>
> Paul Pires wrote:
> > Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:
<snip>
> >
> > As I told you, I am not quibbling with any specific straw-man.
> > I am not going to attempt to critique each one you cite.
> > I have a problem with the idea of a generic solution to the
> > problem in general.
> >
> > We are at that point of diminishing returns again.
> > I will not respond to any more diversions from
> > my post.
>
> You needn't respond, certainly, since this group is free!
> But you don't give any direct arguments!

I'ts not free. Some spend a lot of time and thought to
developing or adding to the content here. Some put
a lot of effort into benefiting from that content. Some
do neither.

As I said before, we are not arguing.

Look, I know you can go on like this forever without
getting to the point so I'll throw you a bone.

A chosen ciphertext or plaintext would be constructed
according to a particular crypto system. How could
you dream of stopping at the design stage, (in a generic
way) an attack specific to the design that won't exist until
that design stage is past? How can you prove that a strategy
will work on something that won't exist until after you have
implemented the strategy?

One way would be to eliminate the property that the attack
is based on. Choosing the plaintext or ciphertext. I think
I have already demonstrated that neither of these is a good
idea.

I don't know how many different ways I can say this. You wish
to take the other position. That's fine with me. You speculate
that certain things would help and expect me to refute your
position or defend mine.

Sorry, I'm sick that day.

> The saying that
> 'P is still there' will apply even to multiple encryptions
> (cf. e.g. the cascade mentioned by Savard), for certainly
> someone must provide a P from outside the system to encrypt
> to C. If you don't have P, you also don't have C. Do you
> see the nonsensical point?

Yes, I do. I belive that was my point. You can't build
a useful system that prohibits the choosing of plaintexts
or ciphertexts (not and still support the application)
So, you can't stop chosen plaintext or ciphertext attacks.
I would think this was obvious.

Can you stop such attacks from being practical?
Probably can, in very specific instances.

Can you devise a primitive to use generally so they are
generally proven harmless? I have already stated my opinion.
You have not shown me to be wrong, Why should I argue?

Paul
>
> M. K. Shen
> -------------------------------------------
> Was sich ueberhaupt sagen laesst, | What can be said at all can
> laesst sich klar sagen; und wovon | be said clearly; and
> man nicht reden kann, darueber | whereof one cannot speak
> muss man schweigen. | thereof one must be silent.
> |
> Ludwig Wittgenstein | (Translation of C. K.
> (1889 - 1951) | Ogden and F. Ramsey)
>



Relevant Pages

  • Re: Bad news for Block Ciphers?
    ... >Any ciphertext only attack should use some knowledge about plaintexts ... If you cannot distinguish possible plaintext from random ... No in most modern encryption sytems that use compression and padding ...
    (sci.crypt)
  • Cryptography FAQ (04/10: Mathematical Cryptology)
    ... what is a private-key cryptosystem? ... What's a ciphertext-only attack? ... D_K) = P for every plaintext P. ... of ciphertext into plaintext is accomplished using the same key ...
    (sci.crypt)
  • Cryptography FAQ (04/10: Mathematical Cryptology)
    ... what is a private-key cryptosystem? ... What's a ciphertext-only attack? ... D_K) = P for every plaintext P. ... of ciphertext into plaintext is accomplished using the same key ...
    (sci.crypt)
  • Cryptography FAQ (04/10: Mathematical Cryptology)
    ... what is a private-key cryptosystem? ... What's a ciphertext-only attack? ... D_K) = P for every plaintext P. ... of ciphertext into plaintext is accomplished using the same key ...
    (sci.crypt)
  • Re: A doubt...
    ... Paul Pires wrote: ... > If the plaintext is totally random, ... > from the ciphertext since none could be gotten from the plaintext. ...
    (sci.crypt)