Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob compare the plain text he sent to Alice with the encrypted version to guess, for example, what is Alice's AES key?

share|improve this question

If the encryption is any good, no. What you're describing is a known-plaintext (or possibly chosen-plaintext) key recovery attack, and any encryption system that was even suspected of being vulnerable to such attacks would be considered hopelessly broken by modern standards.

The "gold standard" that modern encryption methods aim for is generally taken to be "IND-CCA2" security, or ciphertext indistinguishability under an adaptive chosen-ciphertext attack. Loosely speaking, this security property means that an attacker who gets to choose two plaintexts (of equal length) to be encrypted and sent back to them, and may also request the encryption or decryption of any number of other messages, will not be able to tell which ciphertext corresponds to which plaintext.

share|improve this answer
I believe that AES-CTR, at least, has IND-CPA security. This means that the answer to the OP's specific question is no. – gereeter Jun 20 '12 at 16:37
@gereeter: Indeed, AES, or any other secure block cipher, is IND-CPA secure in all the classic non-deterministic modes of operation (CBC, CFB, OFB and CTR), provided that an appropriate IV or nonce is used. However, it's worth noting that no non-authenticating cipher mode can achieve full IND-CCA2 security, since all such modes are at least somewhat malleable. For IND-CCA2, you need to encrypt-then-MAC or use an authenticating encryption mode. – Ilmari Karonen Jun 21 '12 at 11:16
@IlmariKaronen, aren't you rather reducing the attack model to CPA when you are using a MAC (rather than providing IND-CCA/IND-CCA2)? – David 天宇 Wong Dec 14 '15 at 14:51
@David天宇Wong: That's basically what adding a message authentication layer does: it makes the probability of a successful decryption oracle query (on a message not previously obtained from the encryption oracle) negligible, and thus effectively makes the CCA game identical to the CPA game. – Ilmari Karonen Dec 14 '15 at 14:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.