Editing Common Scrambling Algorithm (section)

===Known-plaintext attack===
In 2011, a group of German researchers released an attack<ref>{{cite conference <!-- Citation bot no -->
 | first1 = Erik | last1 = Tews
 | first2 = Julian | last2 = Wälde
 | first3 = Michael | last3 = Weiner
 | title = Research in Cryptology | chapter = Breaking DVB-CSA | conference = 4th Western European Workshop, WEWoRC 2011, Weimar, Germany, July 20–22, 2011
 | series = Lecture Notes in Computer Science | date = 2012 | volume = 7242 | pages = 45–61 | doi = 10.1007/978-3-642-34159-5_4 | isbn = 978-3-642-34158-8 | chapter-url = https://ris.utwente.nl/ws/files/24821147/Breaking_DVB_CSA.pdf | editor1=Frederik Armknecht|editor2= Stefan Lucks| publisher= Springer 
}}</ref> on CSA as used in the DVB system. By noting that MPEG-2 padding frequently requires long series of zeroes, leading to entire 184-byte cells being encrypted with zeroes only, it is possible to build up a [[rainbow table]] recovering the key from such a known-zero block. (A block would be known to be zero if two blocks with the same ciphertext were found, since presumably both would be zero blocks.) The attack described would require about 7.9 TB of storage, and enable an attacker with a [[GPU]] to recover a key in about seven seconds with 96.8% certainty. However, the attack is only effective when such all-zero padding blocks are present (i.e., in scenes with very little movement or noise), and it would be easily mitigated by for instance sending such all-zero cells unencrypted.

This differs from the brute-force attack examples already mentioned, in that the plain-text contents of the entire cell is known before the attack, not just parts of a block, which enables the ahead-of-time computation of the rainbow table.