A natural language approach to automated cryptanalysis of two-time pads

Abstract

While keystream reuse in stream ciphers and one-time pads has been a well known problem for several decades, the risk to real systems has been underappreciated. Previous techniques have relied on being able to accurately guess words and phrases that appear in one of the plaintext messages, making it far easier to claim that "an attacker would never be able to do that." In this paper, we show how an adversary can automatically recover messages encrypted under the same keystream if only the type of each message is known (e.g. an HTML page in English). Our method, which is related to HMMs, recovers the most probable plaintext of this type by using a statistical language model and a dynamic programming algorithm. It produces up to 99% accuracy on realistic data and can process ciphertexts at 200ms per byte on a $2,000 PC. To further demonstrate the practical effectiveness of the method, we show that our tool can recover documents encrypted by Microsoft Word 2002 [22].

When cryptography meets storage

“…N-gram analysis [18,27] can be used in conjunction with frequency analysis or on its own. Like frequency analysis, lists of n-character strings, or n-grams, can be tallied from a representative training set.…”

“…The two-time-pad problem [27] describes how a key is reused to encrypt two plaintexts P and P', where P ⊕ key and P' ⊕ key can be XORed to recover P ⊕ P'. Although XOR-based streamcipher attacks are well-known, these weaknesses have not stopped storage designers from using fast encryption modes to support efficient random in-place updates without re-encrypting the remaining file after the updated file location.…”

“…Much of the related work on algorithms [18,27,42] and implementations [40,9] of cryptanalysis on two-time pads was already discussed in Sections 3.1 and 3.2. Most of the work reviewing two-time pad vulnerabilities is explored in the context of network communications.…”

On the security of security extensions for IP-based KNX networks

“…The usage of the same counter value T 0 in combination with the same group key can break the confidentiality of group communication because of the "Two-Time-Pad problem" [11].…”

“…This procedure is not explicitly described. The only description given on the sequence number is quoted as follows and does not refer to resynchronization: "To ensure data integrity and data freshness, HMAC [11] in combination with SHA 256 [12] and a sequence number are used." [2].…”