While looking at this question I discovered the following here (question 5), and wanted to ask it as a separate question.
Alice knows that she will want to send a single 128-bit message to Bob at some point in the future. To prepare, Alice and Bob first select a 128-bit key k ∈ {0, 1}128 uniformly at random.
When the time comes to send a message x ∈ {0, 1}128 to Bob, Alice considers two ways of doing so. She can use the key as a one time pad, sending Bob k ⊕ x. Alternatively, she can use AES to encrypt x. Recall that AES is a 128-bit block cipher which can use a 128-bit key, so in this case she would encrypt x as a single block and send Bob AESk(x).
Assume Eve will see either k ⊕ x or AESk(x), that Eve knows an initial portion of x (a standard header), and that she wishes to recover the remaining portion of x. If Eve is an all powerful adversary and has time to try out every possible key k ∈ {0, 1}128, which scheme would be more secure?
And the answer in the document is:
They would be equally secure. Either way, Eve would not be able to learn the unknown portion of x.
Even after trying every possible key (including the actual one), Eve will have no way of recognizing the correct plaintext or even narrowing down the possibilities in any way. Why is this? Well, since AES is a distinct permutation on {0, 1}128 under each possible key, and the key was selected uniformly at random, given any plaintext, each possible ciphertext is equally likely. So when AES is used for a single block with a random key of the same length, the effect is exactly the same as using a one time pad: the ciphertext reveals no information about the plaintext.
The question mentions a standard header, so I think its fair to assume we know all the plaintext except the very last bit. So my question, is this answer correct?