Can you reverse-generate the RSA/AES key if you have the decrypted and encrypted version of the same string? (JS client-side crypto)

MichaelB :

Trying to do some client-side encryption for some configuration credentials (nothing sensitive) in angular. But if I import the module with the wrong credentials, everything will crash.

So I'm thinking before-hand if I could test out with a small string if the encryption key is correct or wrong, before deciding to load the module.

This would require me to have in my client code a decrypted and encrypted version of the same string which leads to me trying to find out if it is possible for someone to use that.

DraxDomax :

Any modern professional-grade algorithm? No. This is a security vulnerability (known-plaintext or "crib" attack), it has been a concern since the Enigma days and, of course, a primary design goal for asymmetric encryption which followed.

AES, for example, iterates the key over the plaintext a many times, to the point where a reverse function cannot be calculated. The remaining method for the attacker is to run keys in a brute-force way. If the plaintext string is shorter than the key, than we can throw the idea out at this point, as there is not enough information. If the string is as long as the key, and the key is of professional length, this brute force will be an "all computing power by the end of the universe" problem.

Guess you like

Origin http://43.154.161.224:23101/article/api/json?id=302672&siteId=1