AES Threat Model

Question

I've read/skimmed a few documents about the AES family of encryption, but haven't seen anything about what exactly it protects against. There are many ways to "encrypt" things, and not all of them provide the same set of guarantees. For example:

1. Can an attacker, knowing the plaintext, alter the ciphertext in a way such that subsequent decryption yields a plaintext of the attacker's choosing?
2. Can an attacker, given multiple ciphertexts encrypted with the same passphrase, calculate the key? Or reduce the security of the given ciphertexts?
3. Take one plaintext and encrypt it into two ciphertexts, using the same passphrase. Can an attacker determine that the ciphertexts have the same plaintext?
4. If the ciphertext is corrupted, can the decryption algorithm detect that?

Etc. There are no doubt many more attacks that could be performed. I'd like to know what AES guarantees, assuming its strength and correct implementation.

Answer 1

1: Depending on the mode that is possible, that is why we authenticate ciphertext.

2: Probably not.

3: Depends on the mode and the process used to convert the passphrase into the AES key.

4: No.

AES is a block cipher. It uses a key to encrypt 128-bit blocks of data. There are many many ways to do this. Above the cipher is the mode of operation, and above that is the scheme/protocol. Beside that is how the key is generated. All of these must me considered in a threat model.

To address specific comments relating to GPG

GNU PG uses 2 modes, puclic key mode and symmetric password based encryption mode. These generally use the same enciphering mode, but the key and authentication is different.

Public key mode uses CFB mode with full block feedback and a random IV, then it signs the ciphertext. It uses a random key for each message. The key is then encrypted with the recipient public key so that only the recipients private key can recover the encryption key and decrypt the ciphertext.

Symmetric key mode derives the key from the password, the default is 65536 iterations of SHA-1 with an 8 byte salt, that salt may only be 48-bits but that is not bad. The iteration count however, you can manually increase that within limits, I would go to at least 16 million. Note that in some versions the iteration count may be calculated based on system performance, and vary between 65536 and 65011712, which is 31 * 2$^{21}$, the maximum allowed iteration count. The algorithm used is SimpleS2K, which is used for backwards compatibility with the OpenPGP standard.

I am not sure on the defaults, but I believe the symmetric mode does have an authentication code, and the default should generate a unique encryption key for every message, so recovering the key will not expose other ciphertexts with the same password. The password is much easier to recover however, which is why you want more iterations or a better password.

Going back to the original questions but specific for GPG symmetric:

1: Not if the ciphertext is authenticated

2: No.

3: No.

4: No, but a message signature will, I suggest signing all ciphertexts.