5
$\begingroup$

The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit. I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV.

My question, as the title states, is it possible to reverse engineer the key for 1.3 million cypher texts without knowing the key nor the IV but with the knowledge that all the clear texts are the same.

From experience I know, it would not be easily possible to decrypt the first block without the right IV but how would the security of the rest of the block be impacted ?

Edit:

Situation 2: will knowing some portion of the clear text make it easier to guess the key ? Suppose the data is padded using PKCS7 specifications effectively making, lets say, the last 12 bytes of the clear text to be "0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c" as the string is 36 byte long.

An easy solution would be to fill the last 12 bytes with pseudorandom data. However, I am interested in knowing the consequences of not following such an approach.

Improve this question
$\endgroup$
3
  • $\begingroup$ To answer your "Situation 2", modern ciphers such as AES are designed not to be vulnerable to known-plaintext attacks. Predictable padding is not an issue. $\endgroup$
    – Matt Nordhoff
    Commented Jan 19, 2014 at 4:55
  • 1
    $\begingroup$ Keep in mind that CBC mode does not ensure authenticity. An attacker who can submit ciphertexts to your service may be able to manipulate those ciphertexts in such a way that your service inadvertently reveals the plaintext. $\endgroup$
    – Stephen Touset
    Commented Jan 19, 2014 at 5:35
  • $\begingroup$ Situation 2 has been answered here and on Security.SE $\endgroup$
    – rath
    Commented Jan 19, 2014 at 5:39

1 Answer 1

Reset to default
6
$\begingroup$

No, for the same reason that you can't crack 1.3 million ciphertexts knowing they use the same key but different plaintext.

As long as the CSPRNG you use to get your IVs is strong, you're safe.

You are correct in that decrypting the first block without the right IV is not possible. If it were, we wouldn't be using CBC. But yeah, if he could somehow guess the right IV and key for a certain block, he'd be able to decrypt all the following.

For situation 2 take a look at this question.

Improve this answer
$\endgroup$
2
  • $\begingroup$ > somehow guess the right IV and key for a certain block Interesting, this would make the key effectively 256 bit long. I have edited the question and added a second part. Could you also answer that ? $\endgroup$
    – user11507
    Commented Jan 19, 2014 at 4:23
  • 1
    $\begingroup$ No applies to "is it possible to reverse engineer the key for 1.3 million cypher texts without knowing the key nor the IV but with the knowledge that all the clear texts are the same" in the question, not to "Is it safe to encrypt same cleartext with same key but with million diferent IV?" to which the answer is yes. $\endgroup$
    – fgrieu ♦
    Commented Sep 20, 2017 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.