# Key cracking: Prefer many small texts over one large text?

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to see cryptotexts of many IVs than of a single IV?

Does the answer change if also the plaintexts (many small, possibly similar, plaintexts or one large) are available to the cracker?

Does the answer differ per (approved) crypto algorithm and mode?

I assume perfect implementations, IVs etc. but assume nothing about the properties of the plaintext, except that the attacker does not get to choose it.

If these are too many questions, requiring too long an answer, focus on the first.

-

Assuming perfect implementations and good block ciphers, it doesn't matter (for any of your questions).

As long as the underlying block cipher is good and has a long enough block length (e.g., 128 bits, as all versions of AES have), any good mode of operation has a security theorem guaranteeing security against chosen plaintext attack for a total of about $2^{b/2}$ blocks of data, where $b$ is the block length. For $b=128$, that's $2^{64}$ blocks, which is more than anyone could ever have time to generate or encrypt (or store).

All this applies to CPA security, which is an even stronger property than resistance to key cracking.

-

The short answer is that cracking the key of (black-box) AES is impractically difficult. If you introduce sidechannel leakage then it's a very different story, but that's probably not what you're interested in.

Let us ignore the mode of operation completely, and assume that the attacker is allowed to directly query both $\mathcal{E}_k(\cdot)$ and $\mathcal{D}_k(\cdot)$ with any message he likes (clearly he does not know the value of $k$). Assume that he can choose these messages adaptively (ie, he doesn't have to decide what the $i^{th}$ query will be until he has done some calculation based on the results of queries $1$ to $i-1$).

His objective is to tell us whether $$\mathcal{E}_k(m) = \mathrm{AES}_k(m) \qquad\text{and} \qquad\mathcal{D}_k(m) = \mathrm{AES}_k(m)$$ Or if $$\mathcal{E}_k(m) = \pi(m) \qquad\text{and} \qquad\mathcal{D}_k(m) = \pi(m)$$ For some $\pi$ sampled uniformly from the set of all permutations of $2^{128}$ elements.

Even in this (almost certainly stronger) scenario, we currently believe the attacker cannot win the game within even vaguely practical resources (Time,money,energy etc). If there was a way to efficiently recover the key, then an attacker could use this technique against $\mathcal{E}_k(\cdot)$ to guess a key $\bar{k}$, then check if $\mathcal{E}_k(m)=\mathrm{AES}_\bar{k}(m)$ for a few messages $m$.

-