Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the original block.

Can I get the encryption key, using this information?

share|improve this question
add comment

migrated from security.stackexchange.com Oct 4 '12 at 9:13

This question came from our site for Information security professionals.

2 Answers

up vote 5 down vote accepted

As far as is publicly known, no, you can't.

If you could, that would constitute a practical known-plaintext key recovery attack on AES, and the existence of such an attack would mean that AES would be considered totally insecure by modern cryptographic standards.

If you do figure out how to do that, publish it and you'll be famous. (Or, if you'd prefer money over fame, take it to your local/favorite intelligence agency or organized crime syndicate. But note that this option carries some significant risk, since whoever you sold that information to would now have a considerable interest in preventing you from selling it to anyone else).

One exception to this is the case where the keyspace is (or you suspect it may be) sufficiently small to allow a brute force exhaustive search of it. That could e.g. be the case if the key is derived from a passphrase that may not have been chosen securely (that is, at random from a sufficiently large pool of combinations). In that case — especially if no delibrately slow key derivation function was used to strengthen the key — you could just write some code (or build some hardware) to try all likely passphrases until you find one that gives the correct encryption.

share|improve this answer
    
Thank you! I'm not a cracker. I am developing a cryptosystem, which is the need for rapid deciphering arbitrary blocks of the file. So I chose the ECB instead of CBC and wanted to make sure that in this case I did not make a hole in my system. –  Denis Bezrukov Oct 4 '12 at 11:36
1  
@Denis Bezrukov: CBC also allows you to decipher an arbitrary block of the file; compared to ECB, the extra cost is only a XOR with the previous ciphertext block, following decryption. –  fgrieu Oct 4 '12 at 12:21
1  
@Denis: The problem with ECB mode is not that it can leak the key, it's that it can leak information about the data being encrypted. If you want a secure mode of operation that allows fast deciphering of arbitrary blocks, use CTR instead (although, as fgrieu notes, CBC decryption also allows random access fairly efficiently). –  Ilmari Karonen Oct 4 '12 at 14:16
1  
@Denis You are making a hole in your system by using ECB. There are other modes of operation that you can use which provide the ability to decrypt random blocks. Check the disk encryption theory Wikipedia article for a primer on this. –  Stephen Touset Oct 4 '12 at 17:43
add comment

No for practical definitions of possible, assuming the key was chosen truly randomly, and no side-channel information is available (such as the power-consumption traces of the encrypting device, or the time it took, for many encryptions).

The design of AES strives to be such that the best way to find the key from plaintext-ciphertext examples is to try keys among the $2^{128}$ possible keys. As far as we know this goal is reached for all practical purposes (within a small factor like 4, subject to debate, which we can neglect). If we tested 10 thousand of million keys per second for a year on a million of million devices, odds of hitting the right key are less than 1 in a thousand of million.I've purposely avoided the ambiguous billion.

share|improve this answer
    
[+1] for that mini-notice. ;) –  e-sushi Mar 11 at 17:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.