6
$\begingroup$

Let's say that we have a hardware AES implementation that, on request, will encrypt or decrypt a 16-byte block of data in ECB mode using a fixed key, but refuses to reveal its fixed key. In other words, an oracle.

This oracle has a flaw: if you read the hardware's output registers before the device says that its output is ready, it will return the result of the intermediate rounds rather than only the 10th (final) round.

Is it possible to attack this system to go after the embedded key? I suppose that this means my question is about chosen-plaintext attacks against reduced-round variants of Rijndael-128.

Improve this question
$\endgroup$
1
  • $\begingroup$ I'd say the practical application depends on whether you can obtain states of consecutive rounds. If you can, key extraction seems quite trivial as it boils down to re-doing $SubBytes$, $ShiftRows$, $MixColumns$, and then computing round key by reversing $AddRoundKey$ transformation. $\endgroup$
    – Andrey
    Aug 18, 2014 at 7:44

1 Answer 1

Reset to default
3
$\begingroup$

If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys. Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible.

Take for example round 1: you get the internal state before AddRoundKey (of round 2), you get back at the beginning of round 1, and you get the plaintext XORed with the first round key.

Finally, recovering all round keys is equivalent to recover the master key.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Any round key is sufficient to recover the master key. $\endgroup$
    – Dmitry Khovratovich
    Aug 18, 2014 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.