Known-ciphertext attack