Also known as: known-plaintext attack, KPA
A known-plaintext attack (KPA) gives the attacker a set of matched plaintext–ciphertext pairs that they observe but do not choose, and uses them to recover the key or the algorithm itself.1 Such a matched pair is historically called a crib. It is stronger than a ciphertext-only attack and weaker than a chosen-plaintext attack.
How it works
Each matched pair is an equation linking the unknown key or transform to observed bytes. A handful of pairs may under-determine the cipher, but many pairs at varied lengths over-determine it — fitting any candidate model and rejecting those that fail to round-trip all pairs. The method underlies most practical reverse engineering of an undocumented encoder: collect pairs, hypothesize a structure, and keep only parameters consistent with every pair. It feeds directly into the stronger machinery — an algebraic solve turns the pairs into a linear system, while differential analysis exploits pairs that happen to differ in just one position.
In practice
Cribs are powerful because real plaintext is rarely random. Predictable fields — a fixed message header, a stereotyped greeting, a daily weather report, or a protocol’s mandatory framing — hand the attacker plaintext for ciphertext they already hold. The most famous example is Bletchley Park’s use of cribs against the Enigma: guessing that an intercept contained a routine phrase such as a weather station’s call let the bombes test rotor settings against a known word.2 The modern echo is any system that sometimes sends a field in clear and sometimes protected: the clear instances become cribs for the protected ones. The attack’s ceiling is coverage — a corpus only teaches the cipher about the inputs that actually occurred, so rare transitions stay unconstrained until a chosen-plaintext sweep fills them in.
Relevance to SDR
When a system’s text (unit aliases, callsigns) is sometimes broadcast in clear and sometimes obfuscated, a listener can assemble a known-plaintext corpus. GopherTrunk’s clean-room work on the Motorola P25 talker-alias obfuscation (issue #773) used a 3,607-pair corpus to recover the cipher’s 256-entry substitution table and characterize it as a length-seeded 16-bit state machine — without reading any third-party source. It pairs naturally with differential and algebraic techniques.
Sources
-
Known-plaintext attack — Wikipedia, for the attack model and the term “crib.” ↩
-
Cryptanalysis of the Enigma — Wikipedia, for the historical use of cribs against a real cipher. ↩