Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob compare the plain text he sent to Alice with the encrypted version to guess, for example, what is Alice's AES key?


2 Answers 2


If the encryption is any good, no. What you're describing is a known-plaintext (or possibly chosen-plaintext) key recovery attack, and any encryption system that was even suspected of being vulnerable to such attacks would be considered hopelessly broken by modern standards.

The "gold standard" that modern encryption methods aim for is generally taken to be "IND-CCA2" security, or ciphertext indistinguishability under an adaptive chosen-ciphertext attack. Loosely speaking, this security property means that an attacker who gets to choose two plaintexts (of equal length) to be encrypted and sent back to them, and may also request the encryption or decryption of any number of other messages, will not be able to tell which ciphertext corresponds to which plaintext.

  • $\begingroup$ I believe that AES-CTR, at least, has IND-CPA security. This means that the answer to the OP's specific question is no. $\endgroup$
    – gereeter
    Commented Jun 20, 2012 at 16:37
  • 1
    $\begingroup$ @gereeter: Indeed, AES, or any other secure block cipher, is IND-CPA secure in all the classic non-deterministic modes of operation (CBC, CFB, OFB and CTR), provided that an appropriate IV or nonce is used. However, it's worth noting that no non-authenticating cipher mode can achieve full IND-CCA2 security, since all such modes are at least somewhat malleable. For IND-CCA2, you need to encrypt-then-MAC or use an authenticating encryption mode. $\endgroup$ Commented Jun 21, 2012 at 11:16
  • $\begingroup$ @IlmariKaronen, aren't you rather reducing the attack model to CPA when you are using a MAC (rather than providing IND-CCA/IND-CCA2)? $\endgroup$ Commented Dec 14, 2015 at 14:51
  • $\begingroup$ @David天宇Wong: That's basically what adding a message authentication layer does: it makes the probability of a successful decryption oracle query (on a message not previously obtained from the encryption oracle) negligible, and thus effectively makes the CCA game identical to the CPA game. $\endgroup$ Commented Dec 14, 2015 at 14:59

No, it's not possible. AES has two main properties which makes UNFEASIBLE this attack:

  • Confussion: 'hiding' the letters, eg: first historical symmetric encryptions such as Caesar or Affine ciphers were only based upon this property (ie, a letter is mapped to another one always). Hence, making this encryption suitable for plain-text-attacks. Even using a naive technique in cryptoanalysis called frequency analysis these ciphers could be broken within seconds.

  • Diffusion: is an encryption operation where the influence of one plaintext symbol is spread over many ciphertext symbols with the goal of hiding statistical properties of the plaintext (avoiding frequency analisys attack)

Since AES applies both properties in every round (at least 10, depending on key size) it makes nowadays, at least, unfeasible this attack. With respect figuring out the key, it's, once again, unfeasible. Image that, you've decrypted the message, in order to figure out the key you'd need to brute-force the key to seek for a matching.

For further info please visit my github on which I have implemented both ciphers and their pertinent brute-force methods.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.