Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to see cryptotexts of many IVs than of a single IV?

Does the answer change if also the plaintexts (many small, possibly similar, plaintexts or one large) are available to the cracker?

Does the answer differ per (approved) crypto algorithm and mode?

I assume perfect implementations, IVs etc. but assume nothing about the properties of the plaintext, except that the attacker does not get to choose it.

If these are too many questions, requiring too long an answer, focus on the first.

share|improve this question

Assuming perfect implementations and good block ciphers, it doesn't matter (for any of your questions).

As long as the underlying block cipher is good and has a long enough block length (e.g., 128 bits, as all versions of AES have), any good mode of operation has a security theorem guaranteeing security against chosen plaintext attack for a total of about $2^{b/2}$ blocks of data, where $b$ is the block length. For $b=128$, that's $2^{64}$ blocks, which is more than anyone could ever have time to generate or encrypt (or store).

All this applies to CPA security, which is an even stronger property than resistance to key cracking.

share|improve this answer

The short answer is that cracking the key of (black-box) AES is impractically difficult. If you introduce sidechannel leakage then it's a very different story, but that's probably not what you're interested in.

Let us ignore the mode of operation completely, and assume that the attacker is allowed to directly query both $\mathcal{E}_k(\cdot)$ and $\mathcal{D}_k(\cdot)$ with any message he likes (clearly he does not know the value of $k$). Assume that he can choose these messages adaptively (ie, he doesn't have to decide what the $i^{th}$ query will be until he has done some calculation based on the results of queries $1$ to $i-1$).

His objective is to tell us whether $$ \mathcal{E}_k(m) = \mathrm{AES}_k(m) \qquad\text{and} \qquad\mathcal{D}_k(m) = \mathrm{AES}_k(m) $$ Or if $$ \mathcal{E}_k(m) = \pi(m) \qquad\text{and} \qquad\mathcal{D}_k(m) = \pi(m) $$ For some $\pi$ sampled uniformly from the set of all permutations of $2^{128}$ elements.

Even in this (almost certainly stronger) scenario, we currently believe the attacker cannot win the game within even vaguely practical resources (Time,money,energy etc). If there was a way to efficiently recover the key, then an attacker could use this technique against $\mathcal{E}_k(\cdot)$ to guess a key $\bar{k}$, then check if $\mathcal{E}_k(m)=\mathrm{AES}_\bar{k}(m)$ for a few messages $m$.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.