Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out.

Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you know the pairs $(x_1,y_1)$ and $(x_2,y_2)$. Without knowing $K$, how can you construct a new pair $(x_3,y_3)$ such that $y_3 = AES(K,x_3)$?

It seems like that shouldn't be possible.... right?

share|improve this question
The obvious question is "what do they mean by the AES function()". If it's just AES in ECB mode, then yes, that should not be possible. If they mean AES in some other mode, that might be possible, depending on what that other mode was. – poncho Apr 10 '13 at 1:48
If it's just "the AES permutation" (so to speak), then it should not be possible. $\hspace{1.7 in}$ If it's AES in ECB mode, then it's quite easy. $\;\;$ – Ricky Demer Apr 10 '13 at 5:33

If this is simply the AES permutation on a single block, it's hard to find such a pair.

If it's AES-ECB with multiple blocks, you can pick each block from either (x1,y1) or (x2,y2), producing a new message that contains parts from each of them.

With other modes it depends on that mode, but with many modes there will be a similar mixing attack as for ECB.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.