Skip to main content
Cryptography

Return to Answer

new content and cleanup
Source Link
Richard Thiessen
Richard Thiessen
  • 1.8k
  • 9
  • 13

I wouldn't count on it.NO! AES is rated to withstand cryptanalysis so long as it remains a black box to the attacker (IE:round keys are unknown variables). Thanks toUp until the SHA3 competition entries that reuse parts of AES, cryptanalysis has beenno one had done on AES as a hash function. I wouldn't relycryptanalysis on raw AES to stop the attacker when they can see thewith known internal state.

Several interesting results have been achieved:

  • finding a K such that AESenc(P,K)~=(C) for a given P and C
  • similar attacks with constraints on some key bits and imperfect matching of P and C

These attacks tend to use a sort of meet in This is the middle approach combined with differential cryptanalysis of each roundrelevant paper, specifically section 3.5 which putssolves the roundexact problem you are proposing. Given AES with a fixed key and s-boxes tohether intoK acting as a pseudorandom permutation, find a solution to super s-boxC=AESenc(P,K) with restrictions on C and finds high probability differentials. TheyP

There are completely practical and make usingalso attacks on AES inwhen used as a typical hash construction rolecompression function (IE:state[i]=AES(state[i-1],data[i]K=data[i])) completely insecure. These allow for collisions and generally for breaking the pseudorandom permutation property of AES to find specific solutions for equations involving it.

Relying on AESThere are probably some problems that remain hard, even with a fixed key aslike reversing a strong pseudorandom permutation is riskyone way function composed from AES (IE:F(X)=AES(X,Kfixed)⊕X , Y=F(X) , Find X given Y). In yourEven here I'd be nervous but much less so. This is the ideal case they have freedom to tamper with input bits and. No degrees of freedom for the attacker to tamperwork with some output bits. That could be enough.

When you see "secure pseudorandom permutation" thrown around in the context of AES remember the fine print attached to all that analysis: "for unknown K"

I wouldn't count on it. AES is rated to withstand cryptanalysis so long as it remains a black box to the attacker (IE:round keys are unknown variables). Thanks to SHA3 competition entries that reuse parts of AES, cryptanalysis has been done on AES as a hash function. I wouldn't rely on raw AES to stop the attacker when they can see the internal state.

Several interesting results have been achieved:

  • finding a K such that AESenc(P,K)~=(C) for a given P and C
  • similar attacks with constraints on some key bits and imperfect matching of P and C

These attacks tend to use a sort of meet in the middle approach combined with differential cryptanalysis of each round which puts the round key and s-boxes tohether into a super s-box and finds high probability differentials. They are completely practical and make using AES in a typical hash construction role (IE:state[i]=AES(state[i-1],data[i])) completely insecure.

Relying on AES, even with a fixed key as a strong pseudorandom permutation is risky. In your case they have freedom to tamper with input bits and freedom to tamper with some output bits. That could be enough.

NO! AES is rated to withstand cryptanalysis so long as it remains a black box to the attacker (IE:round keys are unknown variables). Up until the SHA3 competition no one had done cryptanalysis on AES with known internal state. This is the relevant paper, specifically section 3.5 which solves the exact problem you are proposing. Given AES with a fixed key K acting as a pseudorandom permutation, find a solution to C=AESenc(P,K) with restrictions on C and P

There are also attacks on AES when used as a typical hash compression function (IE:state[i]=AES(state[i-1],K=data[i]). These allow for collisions and generally for breaking the pseudorandom permutation property of AES to find specific solutions for equations involving it.

There are probably some problems that remain hard, like reversing a one way function composed from AES (IE:F(X)=AES(X,Kfixed)⊕X , Y=F(X) , Find X given Y). Even here I'd be nervous but much less so. This is the ideal case. No degrees of freedom for the attacker to work with.

When you see "secure pseudorandom permutation" thrown around in the context of AES remember the fine print attached to all that analysis: "for unknown K"

Source Link
Richard Thiessen
Richard Thiessen
  • 1.8k
  • 9
  • 13

I wouldn't count on it. AES is rated to withstand cryptanalysis so long as it remains a black box to the attacker (IE:round keys are unknown variables). Thanks to SHA3 competition entries that reuse parts of AES, cryptanalysis has been done on AES as a hash function. I wouldn't rely on raw AES to stop the attacker when they can see the internal state.

Several interesting results have been achieved:

  • finding a K such that AESenc(P,K)~=(C) for a given P and C
  • similar attacks with constraints on some key bits and imperfect matching of P and C

These attacks tend to use a sort of meet in the middle approach combined with differential cryptanalysis of each round which puts the round key and s-boxes tohether into a super s-box and finds high probability differentials. They are completely practical and make using AES in a typical hash construction role (IE:state[i]=AES(state[i-1],data[i])) completely insecure.

Relying on AES, even with a fixed key as a strong pseudorandom permutation is risky. In your case they have freedom to tamper with input bits and freedom to tamper with some output bits. That could be enough.