Re: Compressed data vulnerable to known-plaintext?

Someone who claimed to be Mark M. said on Sat, 1 Jun 1996:

    (I said:)
> > Why not simply use two session keys, and encrypt the headers with one 
> > while encrypting the actual data with the other? That seems to solve both 
> > problems, except that more CPU cycles are required.
> 
> An easier solution would be to just strip of the headers.  If the header is
> always the same, then it is redundant.  If it varies, then it cannot be used
> as known-plaintext.

But then you still have the problem of identifying the contents.  If there
were no headers, one could not tell if the message was compressed using
ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor,
or even if it was left alone.  One could also not tell if the decryption
happened successfully.

( * Yes, I know tar is not compression. )

-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 1 Jun 1996 anonymous-remailer@shell.portal.com wrote:

> But then you still have the problem of identifying the contents.  If there
> were no headers, one could not tell if the message was compressed using
> ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor,
> or even if it was left alone.  One could also not tell if the decryption
> happened successfully.

OK, I think I misunderstood.  You were talking about encrypting a file that
has already been compressed and I was talking about an encryption program that
would compress then encrypt.  In the latter case, headers would be completely
unnecessary, whereas in the former, they are necessary.  Generally, checksums
or parity bits are much better ways of checking if the decryption was
successful.  While this does make cryptanalysis easier, a known-plaintext will
not work.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm@voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbEWH7Zc+sv5siulAQFA0gP9FMd68l1J8K12FDLkx5+p5j0TwrAlCLn0
cqSHVouOw2mhqk1LEgxMBPuI+6Vw2Bnzhj8QxDz7Qjjs98Jqu4p+4ky9FLzVn4vh
oGi2j/W0P1onLi4bSoq6u1SE8vPCNRresTox36DMWOMSN4Lxybx363xDx+8vD627
5D9n3fW5e/0=
=V+t3
-----END PGP SIGNATURE-----