Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One-Time-Pad is information theoretically secure as long as the random number stream is evenly long or longer than the data stream it encrypts, for a "decyphered" message could have been any message with the same length as the given with the same probabillity. Does the same apply to symmetric ciphers, too?

For instance if I have 1024 bits to encrypt, break it into chunks 128 bits and encrypt it with AES-128, each with a different (assume: true) random key, will that be information theoretically secure just as OTP? Or would a hypothecial prime factorization algorithm (let's assume it would be as quick as the encryption function) impact the (theoretical) security?

In other words: Does using a symmetric encryption algorithm (such as AES) lower the probabillity of a ciphertext being originated from a specific plaintext even if the used key has "OTP-length" and is completely unknown?

share|improve this question
I don't have a proof but my guts tell me the answer is "no", because it does not seem esufficient that the family of functions $f_k$ used by the generalization of the OTP be all bijective, they also have to satisfy the criteria that $\{ f_k(x) \mid k \in \Sigma \}$ be a permutation of $\Sigma$ for all $x \in \Sigma$ (where $\Sigma$ is the relevant alphabet, e.g. the set of all 256-bit strings). XOR, modular addition and other simple constructs trivially satisfy this through symmetry, but AFAIK it is unknown whether there exist $k_1$, $k_2$ such that $AES_{k_1}(x) = AES_{k_2}(x)$ for some $x$. – Thomas Mar 12 '14 at 23:06
I could be way off, though, because I just confused myself. Anyway good question, looking forward to the answers – Thomas Mar 12 '14 at 23:08
To be fair, though, at the point where you have a truly random (not simply from a seeded CSPRNG), why bother with the overhead of a symmetric cipher like AES instead of simply XOR? – Stephen Touset Mar 12 '14 at 23:22
It's about a QKD solution. The question is, as the QKD keys applied with OTP are theoretically secure, would they also be with IPsec? – Marste Mar 12 '14 at 23:27
Do you mean Rijndael? $\:$ (AES's block size is 128 bits.) $\;\;\;\;$ – Ricky Demer Mar 12 '14 at 23:39
up vote 2 down vote accepted

AFAIK, no one has proven that AES on a single 128-bit block with a true-random 128-bit key does not provide information theoretic security (such a proof would probably be the end of AES as it would demonstrate a weakness). OTOH, no one has proven that it does. I suppose it is possible that it does, but such a proof is likely to be extremely difficult. Just look at the simplicity of the ciphers which do provide information theoretic security. The simplicity of the cipher is part of what made it possible to prove. Therefore, due to the lack of a proof showing such a high level of security, and the perceived difficulty of formalizing such a proof, I'm going to have to say the answer is no.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.