Figure out chosen-plaintext-attack in Zerologon attack

Question

Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mentions these sentences:

So I tried to come up with some chosen-plaintext attacks myself and figured out something interesting: for 1 in 256 keys, applying AES-CFB8 encryption to an all-zero plaintext will result in all-zero ciphertext.

and

In fact, this property is a bit more general: when an IV consists of only zeroes, there will be one integer 0 ≤ X ≤ 255 for which it holds that a plaintext that starts with n bytes with value X will have a ciphertext that starts with n bytes with value 0. X depends on the encryption key and is randomly distributed.

I did a lot of web searching on this topic, but I couldn't find any explanation or proof related to those sentences.

Could someone point me in the right direction about any article, paper, document or website where mentioned properties are proved?

Answer 1

So just to be clear, these are not properties of the CFB8 scheme itself - rather, they exist specifically in the context of this attack due to this issue with how windows uses (..or used) the scheme:

The ComputeNetlogonCredential function, however, defines that this IV is fixed and should always consist of 16 zero bytes. This violates the requirements for using AES-CFB8 securely: its security properties only hold when IVs are random.

Regarding proof of the first claim, this excerpt explains it a bit more clearly:

Because AES is a high-quality cipher with no known statistical biases, you can put in any input and encrypt it with any key, and the chance of each individual bit in the output being zero (or one) is 50%. Every output bit’s value is like a digital coin toss. So the chance of the first output byte being zero is the same as the chance that the first 8 output bits are all zero, which is 50% × 50% × 50% … eight times over (50% is just another way of writing 0.50, which is the same as 1/2). 50%8 is 2-8, or 1/256.

The second claim is an extrapolation from the first and I'm afraid my math skills don't reach that far.