The likelihood of breaking, for instance, an AES-128 cipher is 100% after $2^{128}$ tries in brute force, meaning that I've got to try $2^{128}$ keys to certainly break it.

What if I (hypothetically) had recorded $2^{128}$ bits of data encrypted with the same AES-128 key? How does this help in cryptoanalysis?

And how is the situation differently if or if not a part of this data (e.g. word file headers, specific telnet handshakes, whatever) was known plaintext?

  • 4
    $\begingroup$ It will take $2^{127}$ tries on average, not $2^{64}$. If the probability of each guess being correct is $1/2^n$, it takes $2^n / 2 = 2^{n-1}$ guesses to have a 50% chance of success. $\endgroup$
    – Reid
    Commented Mar 12, 2014 at 23:34
  • $\begingroup$ What Maraste may be thinking of is how most modes of operation can be broken with $2^64$ blocks. $\hspace{.46 in}$ $\endgroup$
    – user991
    Commented Mar 13, 2014 at 1:18
  • $\begingroup$ You're, of course, right. In my defense: it was 1 a.m. local time after a very tiring day. :( I corrected it to full 2¹²⁸ tries, as it is maybe more straight forward and doesn't influence the question itself. $\endgroup$
    – Marste
    Commented Mar 13, 2014 at 9:26
  • $\begingroup$ In your 2nd sentence: Just having "bits of ancrypted data with the same key" is looking at the wrong level. First, single bits don't matter, but we always have to look at full blocks. And then: ciphertext only is a very very weak attack scenario. Even for a weak block cipher like DES, this amount of data wouldn't be usefull (for DES, brute force is the way to go nowadays anyway). AES is designed in a way to resist chosen plaintext attacks, which you didn't even mention, but it that is the targeted goal for recent block ciphers. $\endgroup$
    – tylo
    Commented Mar 13, 2014 at 12:55

1 Answer 1


Quite apart from the correction that Reid made (it takes $2^{127}$ attempts to achieve a probability of 50% of finding the right key; with $2^{64}$ attempts, the probability of success is $2^{-64}$), with AES, there is no known way to take advantage of known (or even chosen) plaintext to speed up any brute force search; even with $2^{64}$ chosen plaintext/ciphertext pairs, the best known attack is to pick one pair, and apply a brute force search on that pair.

  • $\begingroup$ I re-using a key in block ciphers doesn't influence cryptanalysis, then why bother with key changes in security protocols (like TLS or IPsec)? $\endgroup$
    – Marste
    Commented Mar 13, 2014 at 9:32
  • 2
    $\begingroup$ @Marste 1) TLS in its typical use doesn't bother changing the key during the lifetime of a connection 2) Changing the key within a connection strengthens forward secrecy 3) More samples don't help brute-force, but might aid cryptoanalysis. There is also a block size dependent limit, which is only a couple of GB for 64 bit blocks. Older protocols worry about these issues since we didn't have AES yet. Nowadays it's less of a concern. $\endgroup$ Commented Mar 13, 2014 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.