Re: Encrypted Communications and Predictable Communications?

----- Original Message ----- 
From: Jonathan Leffler 
Date: Tue, 3 Aug 2004 10:26:14 -0700 
To: [email protected] 
Subject: Encrypted Communications and Predictable Communications? 

> My understanding of cryptography in general is that it is easier to 
> determine the key for an encrypted message if you have (some) known plain 
> text that the encrypted message will probably contain. This might provide 
> you with the leverage to get the rest of the data - the unknown part of 
> the message. 

Having at least an idea about the data is essential.  Things like format, 
char set, etc, are really nice.  But, these don't necessarily equate to 
a known plaintext attack.  That attack type relies on having massive
numbers of plaintext/ciphertext pairs from which the key is deduced.

(...)
> 
> Question: How much does the predictability of such message exchanges 
> degrade the security of an encryption system? Can anybody point to any 
> literature that analyzes this issue? 

I believe this is the crux of the WEP cracking mechanisms which make use
of the predictible fram formats for ARP, DHCP, etc in attacks on the 
wireless networks, isn't it?  I'm sure there would be a good body of 
research on this sort of attack.

> Should the encryption system take steps to ensure that the encrypted data 
> contains random information to pad out messages to at least the minimum 
> block size for the encryption algorithm? Do systems like OpenSSL do that 
> anyway? 

I believe that SSL pads the data record to a multiple of the minimum
block size.