Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am encrypting a string in a format like this:

Byte 1: 1 (this byte is CONSTANT and KNOWN)
Byte 2-18: a random string of characters that is never the same.
Byte 18-34: unknown number that is sequentially incremented each time 
            (it's a primary key from a mySQL AUTOINCREMENT column)

The entire 34 bytes is encrypted using 128 bit AES key.

Let's assume the attacker has access to several million of these strings that were generated sequentially and the attacker has them in order. This means the attacker knows that Bytes 18-34 are several million integers, each exactly 1 apart (eg, 100, 101, 102, 103, etc).

Could the attacker:

  1. Figure out the AES key if the IV used to encrypt all the strings is the same?
  2. Figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known?
  3. WITHOUT figuring out the full key, would it be possible for the attacker to compose their own string that allows them to set their own known value for bytes 18-34, and simply put garbage in the rest of the bytes?

AES is supposed to be immune from known plaintext attacks, but I am having trouble wrapping my head around how far that extends in practice.

Many thanks in advance.

share|improve this question
    
What mode are we talking here? Simply "AES" doesn't have any IV nor can encrypt 34 bytes. AES is a 16 to 16 byte mapping determined by a 16, 24 or 32 byte key. A mode of operation turns that building block into an encryption algorithm, often using an IV. But the exact security properties depend on the mode used. –  nightcracker Aug 8 '13 at 22:17
    
What you're describing here is called 'differential cryptanalysis'. AES is generally thought to be very secure against this kind of attack. –  pg1989 Aug 8 '13 at 22:32
    
nightcracker: CBC mode. –  MattInglot Aug 9 '13 at 3:28

1 Answer 1

up vote 6 down vote accepted

Could the attacker figure out the AES key if the IV used to encrypt all the strings is the same?

No; the AES key is secure against such an attack.

Could the attacker figure out the AES key if the IV used to encrypt all the strings is NOT the same (one IV per string), but known?

No, the AES key is secure against such an attack.

You say that you are having trouble wrapping your head around how strong AES actually is; it extends pretty far. In fact, AES is secure against a chosen plaintext attacker; that is, even if the attacker supplied Gigabytes of data for you to encrypt, and you encrypted them, we still don't know how an attacker would be able to use that to reconstruct the key. This attack model is obviously much tougher on AES than your model (where the attacker just knows some information about the plaintext, but doesn't get to pick it).

WITHOUT figuring out the full key, would it be possible for the attacker to compose their own string that allows them to set their own known value for bytes 18-34, and simply put garbage in the rest of the bytes?

Ah, that's a different question; that actually depends on the mode of operation that you use AES in. The mode of operation is how you use AES (which just defines a transformation between 16 byte blocks to 16 byte blocks) to actually do something interesting, such as encrypting a long text.

What you are asking is 'suppose an attacker takes an encrypted message; could he modify that encrypted message, so that the modified message decrypts into something that the attacker wants (or, at least, parts of the decrypted message is what the attacker wants). Now, there are multiple encrypting modes of operations defined for AES; they differ about how well they handle this.

If you are in a scenario where an attacker might be able to modify the ciphertext, you usually want to use something that detects such games; there are two standard ways of handling this:

  • You can encrypt the message (using any mode of operation that does encryption), and also apply a separate Message Authentication Code (such as HMAC or CMAC) on the ciphertext. The MAC has the property that if anyone modifies it, the computed MAC and the MAC in the message will not agree, and so you know that someone modified the message.

  • You can use a mode of operation that does that inherently (such as GCM); these modes effectively both encrypt and perform a MAC on the message.

share|improve this answer
    
That is what I needed to hear. I will definitely use HMAC. I thought I couldn't use one, but it turns out I was blind to the obvious way to do it. Thank you! –  MattInglot Aug 9 '13 at 13:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.