0
$\begingroup$

Let's suppose I encrypt two blocks of 1MiB with AES-256 in CBC mode, each one using different keys, XOR the resulting ciphertexts and send this XORed block to an adversary. Remembering that the adversary will not have access to resulting ciphertexts, only the XOR of them.

What could he/she do with the XORed block? Can he/she find the keys I used, or even the plaintext of one of the ciphertexts in less than 2^256 tries (256-bits).

This question could sound strange but it's part of one of my researches.

PS: Sorry for my English.

$\endgroup$
4
  • $\begingroup$ "I encrypt two blocks of 1MiB with AES-256 in CBC mode, each one using different keys, XOR the resulting plaintexts". The output of a cipher is ciphertext ,not plaintext. $\endgroup$
    – Maarten Bodewes
    Commented Mar 26, 2023 at 9:43
  • $\begingroup$ @MaartenBodewes Sorry, I corrected the text. $\endgroup$
    – alpominth
    Commented Mar 26, 2023 at 19:18
  • $\begingroup$ If I'm reading it right, since the second plaintext and key are unrelated to the first, the attacker could generate the second ciphertext themselves. Imagine if that made it easier to recover your plaintext. $\endgroup$
    – bmm6o
    Commented Mar 27, 2023 at 15:15
  • $\begingroup$ I suggest looking into existing related key attacks. $\endgroup$
    – tylo
    Commented Mar 27, 2023 at 16:26

1 Answer 1

1
$\begingroup$

Obviously an adversary doesn't gain any advantage if they obtain the ciphertext in the generic attack scenario for CBC mode. The XOR of the ciphertext has less information, so that certainly won't help.

Even if the adversary does get part of the plaintext it would not obtain any additional info when it comes to the cipher. That said, a XOR of a partial plaintext can of course contain information in itself.

Furthermore, if a plaintext oracle exists (CBC is an unauthenticated mode) then it might well be that a XOR of a partial plaintext can be used to obtain more information. That's outside of the security definition of the cipher itself though; it would come down to insecure usage.

$\endgroup$
3
  • $\begingroup$ >The XOR of the ciphertext has less information, so that certainly won't help. -- Can the adversary still brute-force one of the 1MiB encrypted blocks if having only the XOR of the two ciphertexts? $\endgroup$
    – alpominth
    Commented Mar 27, 2023 at 11:06
  • 1
    $\begingroup$ I guess that would be tricky, just like it would be tricky for the consumer of the XOR'ed ciphertext. Impossible to brute-force? No, you take plaintext, try all the keys for both ciphers and see if the XOR matches. Usually part of the plaintext message is known. $\endgroup$
    – Maarten Bodewes
    Commented Mar 27, 2023 at 12:10
  • $\begingroup$ Thanks @Maarten Bodewes, I was thinking it would be impossible. $\endgroup$
    – alpominth
    Commented Mar 27, 2023 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.