# Does having a known plaintext prefix weaken AES256? [duplicate]

I plan on storing data, encrypted with AES256, where the first dozen bytes are known plaintext. ('Hello World!' for example.)

Does having this known plaintext prefix weaken AES256?

I do not care about modifications being made to the ciphertext, which result in modifications to the decrypted plaintext.

I do care about an attacker being able to decrypt any plaintext beyond the known plaintext prefix.

I expect to use counter mode, as random access is required. Does GCM have any advantage?

-

## marked as duplicate by D.W., e-sushi, poncho, rath, archieJul 17 '14 at 3:41

As rightly answered, the answer to the question as in title and second paragraph is NO. $\;$ But suitability of counter mode can't be ascertained, for we do not know: $\;$ A) If the data ever legitimately changes, and how the counter is setup in that case; $\;$ B) If we should consider an attack model where the adversary changes the enciphered data, observes how the system then behaves when manipulating the (modified) deciphered data [e.g. error indication, or lack thereof], and deduce something about the actual clear data. –  fgrieu Jul 16 '14 at 10:28
What research have you done? This is already answered by several questions on this site, e.g., crypto.stackexchange.com/q/1512/351, crypto.stackexchange.com/q/3952/351. (If you'd searched, you should have found them immediately; and they already show up in the related questions list.) We expect you to do a significant amount of research before asking here, including searching on this site for other questions and answers that might shed light on your question. At worst, it will help you frame a better, more focused question; at best, it might answer your question for you. –  D.W. Jul 16 '14 at 19:54
I hope you do care about the attacker modifying the later and take steps to protect its integrity. And that you don't reuse the same aes password for every file (salts are ok) –  Ángel Jul 18 '14 at 21:20

AES-256 has sustained 15 years of cryptanalysis, and it can be stated that no knowledge of some plaintext bytes would help to reveal the other bytes no matter what mode of operation (CBC, CTR, etc.) is used.

AES-GCM is an authenticated encryption scheme that allows a key holder to detect any modification that has been done to the ciphertext. If you do not care about such modifications (which are easy in the Counter mode), then you do not have to use GCM. However, if you can use it, I would definitely recommend doing so.

-
"No matter what mode" - as long as it's not ECB. –  otus Jul 16 '14 at 12:18
You're right :) –  Dmitry Khovratovich Jul 16 '14 at 13:50

When using CTR Mode the AES is used to generate a kind of key stream which itself is the XORed to your plaintext. So AES is actually encrypting an incrementing counter.

At the moment there is no known attack, that would yield E(N) if you do know E(N-1), where N is the aforementioned counter. So this should be safe.

But be aware, as the plaintext is XORed with the key stream it is easy to flip specific bytes ! So an attacker would be able to change e.g. some numbers, if the underlying plaintext format is known or can be guessed.

If you do not want to use GCM or some other AEAD scheme I would advice to attach a MAC (HMAC or CMAC) to your cipher text. But remember, Encrypt-then-MAC.

-
Thanks, this is a really useful answer, but I could only accept one. I will up-vote this when I get to 15 rep. –  Matt Jones Jul 16 '14 at 10:28