Re: Encrypted Communications and Predictable Communications?

On Tue, Aug 03, 2004 at 10:26:14AM -0700, Jonathan Leffler wrote:
> My understanding of cryptography in general is that it is easier to 
> determine the key for an encrypted message if you have (some) known plain 
> text that the encrypted message will probably contain.  This might provide 
> you with the leverage to get the rest of the data - the unknown part of 
> the message.

Historically this is true (a lot of the early Enigma breaks relied on guessed
plaintext). Modern algorithms (pretty much from DES on) have been very
resistant to such attacks. For example, there is an attack against (a reduced
form of) AES which relies on gathering around 2^127 plaintext blocks (~ 2 *
10^21 exabytes).

> 
> With program-to-program message streams encrypted using ... choose your 
> system - OpenSSL or TLS or ... where the programs have a known clear text 
> protocol, and (obviously) the encoding of the messages is known 
> (Kerchoff's Principle: the security is only in the keys), does the known 
> text provide sufficient leverage to allow a session to be cracked offline 
> (or, more precisely, how much known plain text would be necessary to 
> provide that leverage)?
> 

No, not practically. If an attacker could recover keys from a real cipher from
'just' a few hundred terabytes of plaintext/ciphertext pairs, it would be
considered pretty broken. Basically as long as your ciphers are decent and your
protocols don't have holes, message recovery via cryptanalysis is not a
concern. Far more likely is that the keys are protected by weak passwords, or
the PRNG wasn't seeded with enough entropy, something like that.

> Should the encryption system take steps to ensure that the encrypted data 
> contains random information to pad out messages to at least the minimum 
> block size for the encryption algorithm?  Do systems like OpenSSL do that 
> anyway?

Yes and yes. Padding is not needed in modes like OFB and Counter, but for CBC
it's more or less required. One common techinque is PKCS #5, which pads a
plaintext message out to the blocksize by adding N bytes with a value N (01,
0202, 030303, etc). SSL also has an option for random padding to make traffic
analysis harder, but it's not used much AFAIK.

-Jack