2
$\begingroup$

If I have a set of AES ciphertexts, and I know all possible plaintext values. I do not however know which plaintext corresponds to which ciphertext. I also know that the same KEY and IV was used to encrypt. Can I use this information to retrieve the key that was used? Or determine what plaintext a given ciphertext corresponds to?

Thanks

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

Can I use this information to retrieve the key that was used?

No, unless the block cipher (or block cipher implementation) is broken - and AES certainly is not - then you can never retrieve the key from the input / output of the block cipher, regardless of how the block cipher is used.

If the key was not correctly generated then it might be possible to determine and then test a range of possible keys. For this to be feasible the amount of keys should be considerably less than the $2^{128}$ keys you would expect for the lowest AES key size.

Or determine what plaintext a given ciphertext corresponds to?

Possibly, but it depends on which mode of operation is used for the block cipher. If it was CBC mode then you can distinguish starting blocks. So if two ciphertext start with the same 16 bytes of information then you can distinguish this fact. That is however less information then binding plaintext to ciphertext.

CTR mode is very vulnerable to IV or nonce reuse, regardless of the block cipher being used. If CTR mode is used then you can XOR pairs of ciphertext to even retrieve the XOR's of the plaintext that was encrypted for these two ciphertext. You can then try to XOR the plaintext and see which pairs then XOR to the same value. By testing different pairs it would be very easy to bind a plaintext to a particular ciphertext.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Thanks, that makes sense, I would like to narrow it down, dont know if I should ask another question. It is, assume that the data that is encrypted will not exceed the key size. So all plaintexts and ciphertexts will be 32bytes in length, if that makes sense. Will this change the second part of the answer? $\endgroup$
    – Ruan Sunkel
    Commented May 30, 2018 at 15:44
  • $\begingroup$ No, the key size is separate from the block size and block cipher mode of operation. So it won't change the second part one iota. Of course, if you have at most 2 blocks then you may not distinguish plaintext using identical blocks that easily for CBC. Less data to analyze doesn't help any adversary. $\endgroup$
    – Maarten Bodewes ♦
    Commented May 30, 2018 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.