Re:Nonce-misuse resistant cryptography 101
by lvh on Friday May 20, 2016 @10:55PM
(#11742976)
I'm referring to the thing the attacker computes right before that sentence. The attacker has computed:
C_1 ^ C_2 = P_1 ^ P_2
The right hand side is known; it's the two ciphertexts. The right hand side is hence also known, but neither P1 nor P2 is known. Except, of course, if you have a plaintext that has a lot of Z's in it, because then I know one of P1/P2, and I can cancel out the Z's :) Is that what you mean by "indirectly"?
C_1 ^ C_2 = P_1 ^ P_2
The right hand side is known; it's the two ciphertexts. The right hand side is hence also known, but neither P1 nor P2 is known. Except, of course, if you have a plaintext that has a lot of Z's in it, because then I know one of P1/P2, and I can cancel out the Z's :) Is that what you mean by "indirectly"?