now uses a known-plaintext attack instead of bruteforce