Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it.

What if I (hypothetically) had recorded $2^{128}$ bits of data encrypted with the same AES-128 key? How does this help in cryptoanalysis?

And how is the situation differently if or if not a part of this data (e.g. word file headers, specific telnet handshakes, whatever) was known plaintext?

share|improve this question
4  
It will take $2^{127}$ tries on average, not $2^{64}$. If the probability of each guess being correct is $1/2^n$, it takes $2^n / 2 = 2^{n-1}$ guesses to have a 50% chance of success. –  Reid Mar 12 at 23:34
    
What Maraste may be thinking of is how most modes of operation can be broken with $2^64$ blocks. $\hspace{.46 in}$ –  Ricky Demer Mar 13 at 1:18
    
You're, of course, right. In my defense: it was 1 a.m. local time after a very tiring day. :( I corrected it to full 2¹²⁸ tries, as it is maybe more straight forward and doesn't influence the question itself. –  Marste Mar 13 at 9:26
    
In your 2nd sentence: Just having "bits of ancrypted data with the same key" is looking at the wrong level. First, single bits don't matter, but we always have to look at full blocks. And then: ciphertext only is a very very weak attack scenario. Even for a weak block cipher like DES, this amount of data wouldn't be usefull (for DES, brute force is the way to go nowadays anyway). AES is designed in a way to resist chosen plaintext attacks, which you didn't even mention, but it that is the targeted goal for recent block ciphers. –  tylo Mar 13 at 12:55

1 Answer 1

up vote 5 down vote accepted

Quite apart from the correction that Reid made (it takes $2^{127}$ attempts to achieve a probability of 50% of finding the right key; with $2^{64}$ attempts, the probability of success is $2^{-64}$), with AES, there is no known way to take advantage of known (or even chosen) plaintext to speed up any brute force search; even with $2^{64}$ chosen plaintext/ciphertext pairs, the best known attack is to pick one pair, and apply a brute force search on that pair.

share|improve this answer
    
I re-using a key in block ciphers doesn't influence cryptanalysis, then why bother with key changes in security protocols (like TLS or IPsec)? –  Marste Mar 13 at 9:32
2  
@Marste 1) TLS in its typical use doesn't bother changing the key during the lifetime of a connection 2) Changing the key within a connection strengthens forward secrecy 3) More samples don't help brute-force, but might aid cryptoanalysis. There is also a block size dependent limit, which is only a couple of GB for 64 bit blocks. Older protocols worry about these issues since we didn't have AES yet. Nowadays it's less of a concern. –  CodesInChaos Mar 13 at 10:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.