# Found a way to crack AES-128, what now?

I have just found a way to crack AES-128 in a reasonable time (1-2 days). How do I publish and prove this? I remember reading about lots of people who cracked DES and other ciphers but how did they publish their work?

-
1) Consider implementing it. That way you can be sure you made no mistake and you have evidence that you're not crank. Extraordinary claims require extraordinary evidence. 2) Write a paper using LaTeX typesetting and following proper cryptographic notation and submit it to a conference or journal. –  CodesInChaos Aug 25 at 13:04
@hunter: it would count as a break even if he could not decrypt a single ciphertext; it would count as an extremely bad break even if he needed a few gigabytes of chosen plaintext. –  poncho Aug 25 at 14:00
@poncho - yeah I know... I'm not really taking this claim seriously. –  hunter Aug 25 at 14:05
u could have verified your solution by asking here :) –  sashank Aug 25 at 14:46
That comment by @CodesInChaos is the most constructive one (I wish he had posted it as an answer). Assuming to have found a weakness leading to a successful break, that’ld be the way I’ld handle things too. See, a whole community of scientifically oriented people spend decades checking AES… you’ll need to prove your break “beyond doubt” to convince them you’ve found a weakness they’ve missed. Fail that proof and they’ll just giggle. –  e-sushi Aug 25 at 18:39

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the plaintext with a ciphertext-only attack against unauthenticated CTR.

What property of AES do you believe that you've managed to compromise? Under what attack model did you conduct this attack? How was AES used? What block size and mode?

-

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it.

1. Write the code for the attack. Verify that it works on randomly generated data of the kind it requires.
2. If it can break some challenge (e.g. these), do it. Post the results to the challenger or show the results publicly.
3. If it doesn't, state why (e.g. requires $n$ known plaintext-ciphertext pairs). Make it possible for someone else to create a challenge that you can break.

At that point you could convince others that your attack works and could get a paper published or simply release it otherwise (e.g. post the code). Before that you would likely have difficulty getting anyone to take your claim seriously.

-

Assuming for the moment that your claim is correct, I would suggest caution in revealing the details of your findings. After having your results validated by one or two people with the skills to do so (and whom you trust to keep things confidential), then some sort of general announcement (without specifics) would be best, to give people time (say three months) to move to a different method of encryption, before you publish the details. Otherwise, if you just publish without warning a tool to crack an encryption scheme that is widely used, you could be doing a great deal of harm.

-

Make sure you put your name prominently in the source, and publish the source anywhere. If you're right, everyone else will make you famous. If wrong, someone will point out your error.

Send it to Bruce Schneier if you want to start at the top.

-
Why Bruce? And what makes you think that’s starting “at the top”? I’ld say it would be more useful and have more impact when he’ld verify his findings with the creators of Rijndael/AES: Joan Daemen and Vincent Rijmen. That’s starting “at the top” in this case, since a confirmation from their side would leave no room left for discussion. While I respect Bruce, I’m not so sure an AES-related confirmation by Bruce would have the same impact. Thinking about it, Bruce would be one of the people I’ld talk to when finding a weakness/break in Blowfish, Twofish, or Threefish/Skein. But that’s just me… –  e-sushi Aug 25 at 18:54
I feel that Bruce is more interested in security in general than in cryptographic analysis / design lately. But maybe airport security and such is just easier to blog about. –  owlstead Aug 26 at 17:43