= Solution
In a <ciphertext-only attack>, the adversary sees <ciphertexts> but has no supplied corresponding <plaintexts>. In a <known-plaintext attack>, it also knows one or more matching <plaintext>–<ciphertext> pairs. In a <chosen-plaintext attack>, it can select <plaintexts> and obtain their <encryptions>, possibly choosing later inputs from earlier results.
The ordinary <exhaustive key search> is a <known-plaintext attack>: given $x$ and $c=E_k(x)$, try candidate keys $k'$ and compare $E_{k'}(x)$ with $c$. A uniformly selected $m$-<bit> key has average position $(2^m+1)/2$ in any fixed search order, so
$$
\boxed{\text{ordinary exhaustion: known plaintext; approximately }2^{m-1}\text{ encryptions}.}
$$
This counts testing until the actual key is reached. One known pair may leave false candidate keys when $m$ is large relative to the block length $n$; additional pairs distinguish them. If a <plaintext> has recognisable redundancy, a <ciphertext-only attack> can sometimes test keys by that redundancy instead, but this is an additional assumption rather than the standard supplied-pair setting.
Back to article page
