Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > sci.crypt > #32600

Re: What can an attacker see in an encrypted message?

Show all headers | View raw

On 06/10/2015 05:39, Robert Wessel wrote:
> On Mon,  5 Oct 2015 14:02:46 +0200 (CEST), "Anonymous Remailer
> (austria)" <mixmaster@remailer.privacy.at> wrote:
>
>>
>> After seeing all of the cryptanalysis on the ng recently it occurs
>> to me to ask, just how much can an attacker figure out from a
>> ciphertext? What if he or she has some of the passphrase? Here I'm
>> talking about a ciphertext created using one of the algorithms
>> available in gpg.
>>
>> Let's say, purely for example, that the passphrase is the ever
>> powerful "qwertyuiop" that's been brought up here.
>>
>> If the attacker has figured out that "qwer" is a part of the
>> passphrase can that attacker read any of the ciphertext? If so, how
>> much? Does that knowledge of some of the passphrase allow the
>> attacker to figure out the rest of it?
>>
>> And, pretty much on this same subject, could an attacker tell what
>> kind of data is encrypted in a file? Can they tell if it's a binary
>> or a plaintext file that's encrypted?
>>
>> Can they tell much about the contents of the ciphertext at all
>> without having part of the passphrase, or a part of the session key?
>>
>> Could the attacker figure out a frequency of characters, or tell
>> that some particular characters are used in a ciphertext without
>> having the passphrase or session key?
>>
>> Would a nation state attacker be able to figure out much from a
>> ciphertext created using one of the algorithms available in gpg?
>
>
> One thing to add to what the others are saying, is that without
> padding, one thing that you *can* see in an encrypted message is its
> length.  So if you know Alice regularly sends Bob a message that says
> "all quiet on the western front", and you suddenly see a message that
> isn't 30 bytes long, you can assume something is happening that Alice
> is reporting to Bob.  The very existence, and frequency, of traffic is
> also an indicator, as is who's communicating, even if you can't read
> the messages.
>
> Merely encrypting the message so that it cannot be read does not mean
> you aren't leaking information to an adversary - it's just not the
> *contents* of the message.
>

Here is an example from a more recent war (seen from Eve's perspective):

According to one version of events, Osama bin Laden (Bob) was allegedly
tracked down by stalking a courier carrying messages to and from his
hideout.  The content of the messages was apparently not compromised at
the time, simply the fact that someone was taking extreme measures to
hide the communications between suspected Al Q leaders (Alice) and a
single, highly secured house in Pakistan.  The simple fact that this
communication was occurring and the level of security at that house was
enough to make the US (Eve) believe that house contained the #1 Al Q
leader and launch a high risk attack.  Only when they actually stormed
the house did they get final confirmation that their target was there
at all.  Then they proceeded to gather up Bob's copies of messages and
keys.


Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded

Back to sci.crypt | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

What can an attacker see in an encrypted message? "Anonymous Remailer (austria)" <mixmaster@remailer.privacy.at> - 2015-10-05 14:02 +0200
  Re: What can an attacker see in an encrypted message? Richard Heathfield <rjh@cpax.org.uk> - 2015-10-05 13:39 +0100
  Re: What can an attacker see in an encrypted message? Paulo Marques <pmarques@grupopie.com> - 2015-10-05 14:19 +0100
  Re: What can an attacker see in an encrypted message? William Unruh <unruh@invalid.ca> - 2015-10-05 20:46 +0000
  Re: What can an attacker see in an encrypted message? Robert Wessel <robertwessel2@yahoo.com> - 2015-10-05 22:39 -0500
    Re: What can an attacker see in an encrypted message? Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-06 08:01 +0200
      Re: What can an attacker see in an encrypted message? PA7PTL <PA7PTL@panteltje.com> - 2015-10-06 07:07 +0000
        Re: What can an attacker see in an encrypted message? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-06 11:22 +0100
          Re: What can an attacker see in an encrypted message? eugene.styer@gmail.com - 2015-10-06 08:48 -0700
    Re: What can an attacker see in an encrypted message? Richard Heathfield <rjh@cpax.org.uk> - 2015-10-06 10:15 +0100
  Re: What can an attacker see in an encrypted message? Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-06 11:22 -0500
    Re: What can an attacker see in an encrypted message? Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-06 20:12 +0200
      Re: What can an attacker see in an encrypted message? Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-07 19:21 -0500
        Re: What can an attacker see in an encrypted message? Richard Heathfield <rjh@cpax.org.uk> - 2015-10-08 06:33 +0100
          Re: What can an attacker see in an encrypted message? Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-08 22:21 -0500
            Re: What can an attacker see in an encrypted message? Richard Heathfield <rjh@cpax.org.uk> - 2015-10-09 07:34 +0100
  Re: What can an attacker see in an encrypted message? Anonymous <anonymous@foto.nl1.torservers.net> - 2015-10-07 09:20 -0400

csiph-web