Brute force, get AES keys by multiple plain-texts with their cipher-texts

Question

I know that the encryption is AES, and I have multiple plain-texts with their cipher-texts, I don't know the encryption mode (ECB, CFB, etc ...) actually, but I know that the keys and the IV Key (if it's used) are static not changeable.

How can I get the keys, or is there are a way to encrypt a text with the same key, so I can get the cipher-text of any plain-text I want ? Is there any tool or service can I pay to do that ?

Answer 1

No, you can't get the key. That would require a key-recovery attack on the AES block cipher itself, and there are no known practical ways to do that.

Yes, with a fixed key and IV, and the ability to get arbitrary chosen plaintext encrypted, you probably can read any encrypted messages. The details will depend on the mode of operation being used.

With CTR or OFB mode, this is trivial: XORing any ciphertext with the corresponding plaintext will give you the keystream, which you can then XOR with any other ciphertext to decrypt it. Or, if you're feeling lazy, just take any ciphertext and submit it as the plaintext for encryption. Since CTR and OFB mode encryption and decryption are the same operation, this will directly give you the original decrypted message.

With CFB mode, things get a bit trickier, since the keystream will depend on the message being encrypted. The first block is still easy, since the keystream for the first block depends only on the (fixed) IV. In fact, for the first block, CFB and OFB modes are mathematically identical. To decrypt the remaining blocks, we can submit a message for encryption that begins the same way as the message we're trying to decrypt, up to the beginning of the first unknown block, and then contains a block of arbitrary text of our choosing. XORing this arbitrary block of plaintext with the corresponding block of ciphertext then gives us the keystream block we need to XOR with that block of our target ciphertext to decrypt it.

In this particular case, CBC and ECB mode turn out to be that most difficult targets, since they're the only ones out of the five classical cipher modes that actually feed the plaintext through the block cipher. In ECB mode, each block is encrypted independently, which immediately reveals the presence of any repeating blocks in the messages. Furthermore, if we can make a reasonable guess as to what plaintext a block of ciphertext might encode, we can easily confirm that guess by submitting it for encryption and seeing if we get the same ciphertext block back. This might not seem that practical, but there actually are more or less realistic attack scenarios where this attack can allow arbitrary messages to be decrypted byte by byte.

In CBC mode (with a fixed IV), the same attack works directly on the first block. More generally, if you can guess (a prefix of) the plaintext, you can submit it for encryption and compare the ciphertexts to see at which block (if any) your guess first differs from the actual plaintext. Under appropriate conditions (essentially, being able to obtain multiple ciphertexts encoding the same secret plaintext, but shifted by a different number of bytes) this vulnerability can also be exploited in the same way as with ECB mode.

---

To figure out which mode of operation you're dealing with, you can submit some plaintexts for encryption and compare the resulting ciphertexts:

• ECB mode is easy to detect by submitting a plaintext that consists of the same byte repeated over and over. If the resulting ciphertext repeats with a period of one cipher block (16 bytes = 128 bits for AES), you're definitely dealing with ECB mode. Coincidentally, this also tells you the length of the cipher block, if you don't know it already.

• If the XOR of any two different plaintexts (longer than one block) always equals the XOR of the corresponding ciphertexts, then you're dealing with CTR or OFB mode. There's no easy way to tell these two modes apart, but since the same attacks work on both, it doesn't really matter.

• If the XOR of the ciphertexts matches the XOR of the plaintexts for the first cipher block, but then diverges, you're probably dealing with CFB mode. (If only the first byte matches, you may be dealing with the rarely used CFB-8 mode; other feedback lengths down to just one bit are also possible, but even less common.) You can confirm this by submitting two plaintexts with the same first block, and seeing if now the XORs of the plaintexts and the ciphertexts match for the first two blocks, and so on.

• Submitting two plaintexts with the same first block (but different second block) will also let you detect CBC mode: if the first blocks of the ciphertext match, but the second (and any later) blocks are completely different, you're almost certainly dealing with CBC mode or some variant of it (like PCBC).

Note that most of the attacks and tests above only work because the cipher is being used incorrectly with a fixed IV. In normal usage, the IV for each message should be unique (and, for CBC mode, unpredictable), in which case distinguishing different modes using only an encryption oracle becomes a lot harder. You can still apply similar tests if you have access to a decryption oracle, though (since in that case you typically get to specify the IV).

As an exercise, you might want to look at the diagrams on the Wikipedia page on block cipher encryption modes and figure out why these tests (and the attacks described above) work, and what other tests you might be able to carry out to further confirm your mode identification.

Answer 2

No. You are talking about a known plaintext attack against AES. There is no known attack, discovery of such an attack would be invaluable to there likes of MI6, FSB, and the NSA.