Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know the plaintext (26 bytes long) and cryptotext of block cipher (suspected to be AES) in ECB mode. I can generate hundreds or thousands of such samples, but the samples are not arbitrary. What are my chances of recovering the crypto key using brute force methods or using brute-force + some crypto analysis?

Is there any good guidance to pull off padding oracle?

share|improve this question
Is there a padding oracle present? That is very different from a brute-force attack. Padding oracle will get you the plaintext, but not the encryption key. Brute force would get you the encryption key (and the plaintext but you already know that). Statistical analysis will work with ECB but is typically only practical in rare cases and will again only get you the plaintext, not the key. – mikeazo Sep 19 '12 at 13:03
You're right, there's two tihngs: a) plain ol' brute force and then b) there are some areas of the system where I don't know the plaintext but I would imagine that it uses same encryption methods – Konrads Sep 19 '12 at 15:23
up vote 3 down vote accepted

For a key recovery attack, you'd basically need to break AES itself. There are no known practical key recovery attacks on AES (and if there were, it would not be considered safe to use), so your pretty much only hope would be to find some kind of side-channel attack on the AES implementation, or on the overall crypto framework it is part of.

Alternatively, if you suspect that the keyspace is small enough (e.g. if the key is derived from a passphrase which might not have enough entropy), you might be able to find it with a brute force attack. The chance of such an attack succeeding depends entirely on two things: the size of the keyspace you need to test, and the speed at which you can try the keys. The latter, in turn, depends on the computing hardware you have available (and, of course, your skill in utilizing it) and on the complexity of the key derivation process.

Padding oracle attacks, in any case, are specific to CBC mode, and do not allow key recovery. ECB mode, while insecure in other ways, does not suffer from them.

share|improve this answer
"ECB mode[...] does not suffer from them." Are you sure? I'd expect ECB to have the same padding issues. ECB needs the same kind of padding as CBC, and transforms blocks in pretty much the same way. I see no difference between them in that regard. – CodesInChaos Sep 19 '12 at 14:05
@CodesInChaos: I'm not that familiar with padding oracle attacks, but AAUI, at least the original attack by Vaudenay relies on the fact that CBC decryption XORs the block cipher decryption of the last block with the previous ciphertext block. With ECB, that doesn't happen. (It does seem to me that a similar attack should be possible with padded CFB mode, just with the blocks reversed. Of course, CFB mode doesn't really need padding anyway, as the last block can simply be truncated.) – Ilmari Karonen Sep 19 '12 at 14:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.