1
$\begingroup$

I want to implement a PRG (Pseudorandom Generator). As AES is implemented in hardware, I am planning to use AES for efficiency. I am planning to use:

$(AES_k(seed) \| AES_k(seed+1) \| AES_k(seed+2) \|....)$

as a PRG ($k$ represents the key of AES). The receiver of this sequence does not know the random seed, but knows the AES key $k$. So, is this sequence a provably secure PRG, when the AES key is known (at least in ideal cipher model)?

$\endgroup$
3
$\begingroup$

Hint: given $AES_k(seed)$ and the key $k$, what can an adversary compute? Should this be possible for a secure PRG?

A better option would be standard CTR mode, i.e. $AES_{seed}(0) \| AES_{seed}(1), ...$

$\endgroup$
3
$\begingroup$

This is completely broken. In particular, since $k$ is known, given any block $r$ of randomness, it is possible to compute $s=AES^{-1}_k(r)$ and then generate the rest of the sequence by $AES_k(s+1),AES_k(s+2),\ldots$.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.