2
$\begingroup$

I assume that my case is weird but I've the following information:

  • IV: 0x263e or 0x3e26
  • Auth tag: 0x25
  • AES256-GCM encrypted payload: 0x4eec96df534ade4c013a
  • AES256-GCM decrypted payload: 0x0041e36baf2648090174

Regarding the length of the IV and Auth tag, I'm wondering if it is possible to guess the key used to encrypt the payload ?

Improve this question
$\endgroup$
5
  • $\begingroup$ Welcome to the Cryptography site. Is this homework or a capture-the-flag challenge? $\endgroup$
    – kelalaka
    Commented Mar 13, 2019 at 16:07
  • $\begingroup$ The information you're giving is a bit confusing. The authentication tag being only one byte is very strange, because it means forgery can succeed in probability 1/256, which is way too high. Two-byte IVs are also rather unusual, but technically valid. $\endgroup$
    – Myria
    Commented Mar 13, 2019 at 21:56
  • $\begingroup$ No, the key will always be protected by the AES block cipher. However, that's not to say that other attacks on the authentication procedure aren't possible. Could you please answer the questions in the comments? Otherwise the question may be closed. You can comment below or you can add information to your question text. $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 13, 2019 at 22:44
  • $\begingroup$ @kelalaka: Thanks. My question is in the scope of my PhD, so it's for research purpose (homework :)). $\endgroup$
    – Guillaume
    Commented Mar 14, 2019 at 10:02
  • $\begingroup$ @Myria: Actually, I'm a bit confused as well as I have little knowledges about cryptography and AES stuff. But I agree with you that the fact that the auth tag is just 1-byte long seems weird... $\endgroup$
    – Guillaume
    Commented Mar 14, 2019 at 10:06

1 Answer 1

Reset to default
0
$\begingroup$

No.

The short authentication tag makes for high probability of forgery. But that's not relevant here.

The short nonce limits the number of messages that can safely be encrypted with the same key—indeed, narrowing it down to two possibilities limits it to two messages. But you have only one message.

What's left is breaking AES. Good luck!

Improve this answer
$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.