Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I know that almost all stream ciphers are vulnerable to “key reuse” and “bit-flipping” attacks.
Because AES also uses $XOR$ in its algorithm, is it possible for block ciphers – like AES – to be vulnerable to “key reuse” and/or “bit-flipping” attacks?
XOR may be used internally, but that doesn't mean the resulting ciphertext is automatically vulnerable against bit flipping or key reuse attacks. XOR is used for techniques to create confusion & diffusion, over multiple rounds.
An attacker doesn't usually have any influence on those internal operations unless side channel attacks apply (or when we're talking about white-box cryptography). If the attacker does have access, then changing a bit operation for XOR is likely to affect multiple output bits.
As for AES: to create a IND_CCA secure cipher, AES needs to be used within a block cipher mode of operation. That cipher mode could e.g. be CTR or any other mode that generates a key stream. That streaming mode of operation in turn will be vulnerable with regards reuse (same IV/nonce) and bit flipping attacks.
Other modes of operation such as CBC are also vulnerable against IV reuse, although the resulting attacks are much less powerful. For instance, an attacker could distinguish completely identical starts of the plaintext, as the ciphertext will be identical as well.
The same goes for bit flipping, although for CBC mode a whole block + one bit will change. It depends on the implementation if these larger changes will be picked up. If it does, it may result in a plaintext-oracle (e.g. a padding oracle), which may further compromise confidentiality.
So in the end it is (almost) always required to create a unique IV for any cipher and mode of operation. To avoid bit flipping an authenticated mode of operation or (H)MAC could be used.
