What are the implications of XORing ciphertext with plaintext?Does adding complexity mean a more secure cipher?How to attack a “many-time pad” based on what happens when an ASCII space is XORed with a letter?Plaintext block chaining, bad idea why?Would this method deliver a perfectly non-malleable encryption for at least two blocks?Would this method allow fast authenticated encryption using only a single encryption operation per block?Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?Counter mode with $operatornameAES_k(m)$ vs $operatornameAES_m(k)$Does repeated xoring of the (same) key K lower the entropy of K?Replacement for XOR in CBC?What happens if CBC-mode uses the same IV for all processes?Does adding complexity mean a more secure cipher?
Can my American children re-enter the USA by International flight with a passport card? Being that their passport book has expired
When did game consoles begin including FPUs?
Will consteval functions allow template parameters dependent on function arguments?
Could there be something like aerobatic smoke trails in the vacuum of space?
Is random forest for regression a 'true' regression?
How to redirect stdout to a file, and stdout+stderr to another one?
What was Varys trying to do at the beginning of S08E05?
Why did the metro bus stop at each railway crossing, despite no warning indicating a train was coming?
c++ conditional uni-directional iterator
Polynomial division: Is this trick obvious?
Does addError() work outside of triggers?
I recently started my machine learning PhD and I have absolutely no idea what I'm doing
Wifi is sometimes soft blocked by unknown service
Network latencies between opposite ends of the Earth
Would life always name the light from their sun "white"
Why would company (decision makers) wait for someone to retire, rather than lay them off, when their role is no longer needed?
Why are goodwill impairments on the statement of cash-flows of GE?
How does Ctrl+c and Ctrl+v work?
Formal Definition of Dot Product
Understanding Deutch's Algorithm
To whom did Varys write those letters in Game of Thrones S8E5?
Why do galaxies collide
Holding rent money for my friend which amounts to over $10k?
Does the Rogue's Reliable Talent feature work for thieves' tools, since the rogue is proficient in them?
What are the implications of XORing ciphertext with plaintext?
Does adding complexity mean a more secure cipher?How to attack a “many-time pad” based on what happens when an ASCII space is XORed with a letter?Plaintext block chaining, bad idea why?Would this method deliver a perfectly non-malleable encryption for at least two blocks?Would this method allow fast authenticated encryption using only a single encryption operation per block?Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block?Counter mode with $operatornameAES_k(m)$ vs $operatornameAES_m(k)$Does repeated xoring of the (same) key K lower the entropy of K?Replacement for XOR in CBC?What happens if CBC-mode uses the same IV for all processes?Does adding complexity mean a more secure cipher?
$begingroup$
I was intrigued by this question: Does adding complexity mean a more secure cipher?
And it led me to wonder: What are the implications (if any) of XORing a ciphertext with the original plaintext message? So:
$$C=(E_k(m)oplus m)$$
My first impression was: "That sounds like a bad idea.", but is it necessarily? Seems like something similar is being used for Propagating Cipher Block Chaining.
"In PCBC mode, each block of plaintext is XORed with both the previous plaintext block and the previous ciphertext block before being encrypted."
encryption block-cipher stream-cipher cbc xor
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
add a comment |
$begingroup$
I was intrigued by this question: Does adding complexity mean a more secure cipher?
And it led me to wonder: What are the implications (if any) of XORing a ciphertext with the original plaintext message? So:
$$C=(E_k(m)oplus m)$$
My first impression was: "That sounds like a bad idea.", but is it necessarily? Seems like something similar is being used for Propagating Cipher Block Chaining.
"In PCBC mode, each block of plaintext is XORed with both the previous plaintext block and the previous ciphertext block before being encrypted."
encryption block-cipher stream-cipher cbc xor
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
add a comment |
$begingroup$
I was intrigued by this question: Does adding complexity mean a more secure cipher?
And it led me to wonder: What are the implications (if any) of XORing a ciphertext with the original plaintext message? So:
$$C=(E_k(m)oplus m)$$
My first impression was: "That sounds like a bad idea.", but is it necessarily? Seems like something similar is being used for Propagating Cipher Block Chaining.
"In PCBC mode, each block of plaintext is XORed with both the previous plaintext block and the previous ciphertext block before being encrypted."
encryption block-cipher stream-cipher cbc xor
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
I was intrigued by this question: Does adding complexity mean a more secure cipher?
And it led me to wonder: What are the implications (if any) of XORing a ciphertext with the original plaintext message? So:
$$C=(E_k(m)oplus m)$$
My first impression was: "That sounds like a bad idea.", but is it necessarily? Seems like something similar is being used for Propagating Cipher Block Chaining.
"In PCBC mode, each block of plaintext is XORed with both the previous plaintext block and the previous ciphertext block before being encrypted."
encryption block-cipher stream-cipher cbc xor
encryption block-cipher stream-cipher cbc xor
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 hours ago
tjt263tjt263
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 hours ago
tjt263tjt263
1103
asked 5 hours ago
tjt263tjt263
1103
1103
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
tjt263 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
This is not a correct encryption scheme because it cannot be properly decrypted. Consider $Enc_k$ to be the one-time pad (OTP), the key being all zeroes. Then you have that $$C = Enc_0^m(m) oplus m = (m oplus 0^m) oplus m = m oplus m = 0^m$$ for any message. Or consider encrypting some random string r, then you have $C = Enc_k(r) oplus r$ which is basically the OTP. How would you want to decrypt that?
The PCBC mode also does not output this construct as part of the ciphertext but feeds it as input to the block cipher encryption XORed with a plaintext block.
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
tjt263 is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70543%2fwhat-are-the-implications-of-xoring-ciphertext-with-plaintext%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
This is not a correct encryption scheme because it cannot be properly decrypted. Consider $Enc_k$ to be the one-time pad (OTP), the key being all zeroes. Then you have that $$C = Enc_0^m(m) oplus m = (m oplus 0^m) oplus m = m oplus m = 0^m$$ for any message. Or consider encrypting some random string r, then you have $C = Enc_k(r) oplus r$ which is basically the OTP. How would you want to decrypt that?
The PCBC mode also does not output this construct as part of the ciphertext but feeds it as input to the block cipher encryption XORed with a plaintext block.
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
add a comment |
$begingroup$
This is not a correct encryption scheme because it cannot be properly decrypted. Consider $Enc_k$ to be the one-time pad (OTP), the key being all zeroes. Then you have that $$C = Enc_0^m(m) oplus m = (m oplus 0^m) oplus m = m oplus m = 0^m$$ for any message. Or consider encrypting some random string r, then you have $C = Enc_k(r) oplus r$ which is basically the OTP. How would you want to decrypt that?
The PCBC mode also does not output this construct as part of the ciphertext but feeds it as input to the block cipher encryption XORed with a plaintext block.
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
add a comment |
$begingroup$
This is not a correct encryption scheme because it cannot be properly decrypted. Consider $Enc_k$ to be the one-time pad (OTP), the key being all zeroes. Then you have that $$C = Enc_0^m(m) oplus m = (m oplus 0^m) oplus m = m oplus m = 0^m$$ for any message. Or consider encrypting some random string r, then you have $C = Enc_k(r) oplus r$ which is basically the OTP. How would you want to decrypt that?
The PCBC mode also does not output this construct as part of the ciphertext but feeds it as input to the block cipher encryption XORed with a plaintext block.
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$endgroup$
This is not a correct encryption scheme because it cannot be properly decrypted. Consider $Enc_k$ to be the one-time pad (OTP), the key being all zeroes. Then you have that $$C = Enc_0^m(m) oplus m = (m oplus 0^m) oplus m = m oplus m = 0^m$$ for any message. Or consider encrypting some random string r, then you have $C = Enc_k(r) oplus r$ which is basically the OTP. How would you want to decrypt that?
The PCBC mode also does not output this construct as part of the ciphertext but feeds it as input to the block cipher encryption XORed with a plaintext block.
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 2 hours ago
answered 4 hours ago
user69201user69201
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 4 hours ago
user69201user69201
313
answered 4 hours ago
user69201user69201
313
313
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
user69201 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
add a comment |
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
$begingroup$
You lost me. Why OTPs? I was really just thinking of generic block or stream ciphers. Why all zeroes? And what is that first equation? Ciphertext equals message XOR message equals 0 to the power of the length of the message?
$endgroup$
– tjt263
3 hours ago
1
1
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Because encryption schemes are usually required to fulfill the correctness requirement that $Dec_k(Enc_k(m)) = m$. If distinct messages encrypt to zero-strings, this cannot hold. So your approach does not work in general, for example when $Enc_k$ is the encryption function of the OTP. The answer you linked already mentions this: "Xoring the message into the ciphertext removes the ability to decrypt the ciphertext." This is easy to see if you think of encrypting random messages. $0^m$ is the notation for a string of zeroes that is as long as the message $m$.
$endgroup$
– user69201
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Is $D_k(E_k(m))=m$ the same as $m=E_k^-1(C)$?
$endgroup$
– tjt263
2 hours ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
$begingroup$
Yes, because $C$ is $E_k(m)$ and the inverse of $E_k$ is of course decryption $D_k$ (presuming that $-1$ is the inverse op. of course).
$endgroup$
– Maarten Bodewes♦
1 hour ago
add a comment |
tjt263 is a new contributor. Be nice, and check out our Code of Conduct.
tjt263 is a new contributor. Be nice, and check out our Code of Conduct.
tjt263 is a new contributor. Be nice, and check out our Code of Conduct.
tjt263 is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70543%2fwhat-are-the-implications-of-xoring-ciphertext-with-plaintext%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
