# Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the original block.

Can I get the encryption key, using this information?

-

## migrated from security.stackexchange.comOct 4 '12 at 9:13

As far as is publicly known, no, you can't.

If you could, that would constitute a practical known-plaintext key recovery attack on AES, and the existence of such an attack would mean that AES would be considered totally insecure by modern cryptographic standards.

If you do figure out how to do that, publish it and you'll be famous. (Or, if you'd prefer money over fame, take it to your local/favorite intelligence agency or organized crime syndicate. But note that this option carries some significant risk, since whoever you sold that information to would now have a considerable interest in preventing you from selling it to anyone else).

One exception to this is the case where the keyspace is (or you suspect it may be) sufficiently small to allow a brute force exhaustive search of it. That could e.g. be the case if the key is derived from a passphrase that may not have been chosen securely (that is, at random from a sufficiently large pool of combinations). In that case — especially if no delibrately slow key derivation function was used to strengthen the key — you could just write some code (or build some hardware) to try all likely passphrases until you find one that gives the correct encryption.

-
Thank you! I'm not a cracker. I am developing a cryptosystem, which is the need for rapid deciphering arbitrary blocks of the file. So I chose the ECB instead of CBC and wanted to make sure that in this case I did not make a hole in my system. – Denis Bezrukov Oct 4 '12 at 11:36
@Denis Bezrukov: CBC also allows you to decipher an arbitrary block of the file; compared to ECB, the extra cost is only a XOR with the previous ciphertext block, following decryption. – fgrieu Oct 4 '12 at 12:21
@Denis: The problem with ECB mode is not that it can leak the key, it's that it can leak information about the data being encrypted. If you want a secure mode of operation that allows fast deciphering of arbitrary blocks, use CTR instead (although, as fgrieu notes, CBC decryption also allows random access fairly efficiently). – Ilmari Karonen Oct 4 '12 at 14:16
@Denis You are making a hole in your system by using ECB. There are other modes of operation that you can use which provide the ability to decrypt random blocks. Check the disk encryption theory Wikipedia article for a primer on this. – Stephen Touset Oct 4 '12 at 17:43

No for practical definitions of possible, assuming the key was chosen truly randomly, and no side-channel information is available (such as the power-consumption traces of the encrypting device, or the time it took, for many encryptions).

The design of AES strives to be such that the best way to find the key from plaintext-ciphertext examples is to try keys among the $2^{128}$ possible keys. As far as we know this goal is reached for all practical purposes (within a small factor like 4, subject to debate, which we can neglect). If we tested 10 thousand of million keys per second for a year on a million of million devices, odds of hitting the right key are less than 1 in a thousand of million.I've purposely avoided the ambiguous billion.

-