# What is the probability of breaking the AES algorithm?

I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES?

• What is the probability of breaking AES?
• How does the round number influence this probability? Do more rounds really help in decreasing this probability?
• What is the contribution of each round towards enhancing the security?
-
Please note that a block cipher can be used with several modes of execution. A few examples : ECB (Electronic CodeBook), CBC (Cipher Block Chaining), CTR (CounTeR mode) ... In addition to the AES security itself, the mode you pick up can also have some specific security concerns. – Rerito Mar 27 '13 at 12:59
You should be orders of magnitude more worried about security being compromised through a flaw in whatever software you're writing, than in it happening through AES being broken. – Stephen Touset Apr 7 '15 at 16:47
The biclique attack needs $2^{126.1}$ complexity in order to break AES-128 [en.wikipedia.org/wiki/Biclique_attack]. So the probability (allowing active attacks) is slightly smaller than $1/2^{128}.$ Further, Quantum attacks needs $2^{64}$ (but not implemented yet!). – 111 Apr 8 '15 at 13:39

Of course it is technically possible to crack AES. The method for doing this is to guess the correct key. Assuming you know something about the plaintext, you can easily verify that the key you guessed resulted in the correct decryption.

The probability of breaking AES using this method? AES has 128, 192 and 256 bit key variants. Thus if there are $n$ bits in the key, the probability that your guess is correct is $\frac{1}{2^n}$.

What is the role of increasing the rounds and does this make it harder to break? In general, more rounds are required to diffuse bits. That is why you see more rounds with the larger key sizes. In the specific case of guessing the key, it only slows down decryption. It does not change the probability of a break. There are other articles on this site on increasing rounds. I'll try to find them and add links.

What is the contribution of each round towards enhancing the security? This is hard if not impossible to say. If you modified AES to have only 1 round, it would be trivial to break. Up it to 10 rounds for AES-128 and we can't break it. Up that to 1 million rounds and the cipher isn't really much more secure but takes so long to encrypt or decrypt that no one will use it (a kind of dimishing returns). See fgrieu's comment for additional information.

-
There would be practical attacks against reduced-round AES; e.g. this, claiming an attack against 4 rounds with 4 chosen plaintext using $2^{32}$ effort and moderate memory. Theoretical attacks exist for more rounds, e.g this. Difficulty of attack increases "quickly" with the number of rounds, but it is hard to quantitatively characterize. – fgrieu Mar 26 '13 at 12:36
It's hard to believe that the number of rounds was not determined as a result of some numerical analysis. I have asked about this before: crypto.stackexchange.com/questions/2648/… – user1449 Apr 25 '13 at 9:25
The probability of breaking AES is in fact slightly higher than $1/2^n$, as there is an attack on full-round AES. BUT this attack is not much better than brute-force as it requires only slightly less operations and needs a lot of storage ($2^{88}$ Bytes). – SEJPM Apr 7 '15 at 11:29

## protected by Community♦Apr 7 '15 at 11:22

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).