# How would an attacker perform an exhaustive key search on a block cipher using ECB mode?

Do you always assume from Kerchoff's principle, that the attacker has access to everything but the decryption key?

That is, am I to assume that to perform an exhaustive key search, the attacker has a plaintext block and ciphertext block pair.

So an attacker would systematically try every possible key by decrypting the ciphertext? Then he would be able to identify when he has found the correct key if it matches the plaintext?

If he only has the ciphertext is an exhaustive key search still possible?

Should I be looking at what information a block cipher running in ECB mode provides?

Please help!

• "If he only has the ciphertext is an exhaustive key search still possible?" - the odds for this happening are really low as most data will have some pre-defined headers which will be known to the attacker.
– SEJPM
Apr 3 '16 at 12:47

## 1 Answer

I think the attack models establish constraints on the cipher parameters that allow you to confirm guesses in a brute force or probabilistic search.

A simple way to look at it is that they let your write equations involving the cipher parameters. For example, in $c = enc(p,k)$, you can fix two of the parameters and solve for the third. Clearly $c$ (ciphertext) must be obtainable from $\lbrace p,k \rbrace$ (encryption of plaintext $p$ under key $k$), and $p$ obtainable from $\lbrace c,k \rbrace$ (decryption), but $k$ should not be obtainable from $\lbrace c,p \rbrace$ (secure against known-plaintext attacks).

If all you have is ciphertext samples, then you have no means to verify a guess for the key. From an algebraic perspective, you cannot set up an equation using $c$ alone that will allow you to derive anything about $p$ or $k$. However, if you are running in ECB mode, then solving $k$ for one block under known-plaintext gives you $k$ for every other block, including blocks where only $c$ is known.

Sure, you can set up the equations corresponding to a particular attack model, but ciphers are designed so that the equations are not solvable by any means other than exaustive brute force search.