Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

This mode is that each time a random number $K$ is generated, you XOR it with plaintext $M$ and then pass the result to AES.

Since AES is a pseudo random permutation, does AES have the following property?

$$AES(M \oplus K) = AES(M) \oplus AES(K)$$

share|improve this question

2 Answers 2

up vote 9 down vote accepted

No. The AES permutation is not distributive over the XOR operation.

If it were true, this would violate the basic security construction of AES in the Chosen Plaintext Attack model (which is a good model we like to use when evaluating the security of a PRP): An adversary $A$ queries a black box with his own plaintext, trying to decide if the black box is outputting AES permutation of the input or a random one. Successfully guessing which one (AES or a real random permutation) the black box is performing is victory for $A$. So $A$ could issue a request to the AES encryption blackbox for X, Y, and X $\mathbin{\oplus}$ Y, and get back AES(k, X), AES(k, Y), and AES(k, X $\mathbin{\oplus}$ Y). Then he would check that AES(k, X $\mathbin{\oplus}$ Y) = AES(k, X) $\mathbin{\oplus}$ AES(k, Y). If it did, he would know (with negligible error) that he was working with AES and not a random permutation because a random permutation would certainly not have that property. Thus he would break AES under the CPA model with just 3 chosen messages.

share|improve this answer

No, AES does not have such a property. In fact, such a property would be an extremely severe security weakness, as it would allow us to decrypt arbitrary ciphertext if we just had about 128 blocks of known plaintext/ciphertext pairs (!).

As for this "whitening mode", I first heard it proposed by Richard Schroeppel (to give credit where credit is due; he gave it a different name). As for security, it should be quite good (as long as your random numbers K are uncorrelated to the plaintexts you are encrypting).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.