Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs.
What are known possible attacks (apart from the following example) that could help to decrypt the plaintext without knowing the key?
Does some probability analysis exist for the example attack outlined below?
An example for a possible attack:
By looking at how CBC and CTR are done, one possible attack where the attacker knows a certain number of plaintext blocks would be the following. (Please excuse my probably non-standard notation)
- CBC(k) is the kth block of the CBC ciphertext
- CTR(k) is the kth block of the CTR ciphertext
- CTRIV(k) is the kth block of the CTR counter (before being applied to AES)
- PLN(k) is the kth block of the plaintext
we know from how AES-CBC works that:
CBC(n)=AES(key, PLN(n) XOR CBC(n-1))
and from how AES-CTR works that:
PLN(m)=CTR(m) XOR AES(key, CTRIV(m))
so it follows that:
For all (m,n) where
PLN(n) XOR CBC(n-1) = CTRIV(m)
the following is true:
PLN(m)=CTR(m) XOR CBC(n)
And because PLN(n) XOR CBC(n-1) is easily calculated and CTRIV(m) is a stream of consecutive numbers the check can be done very fast.
Now, as I understand this: The longer the encrypted content and the more plaintext blocks the attacker already knows, the higher the probability for finding new plaintext blocks, which again help in finding newer ones.
The probability would also rise if additional reencryptions of the plaintext with the same key and random IVs are done, because more CBC(n) and/or CTRIV(m) blocks can be gathered.