3
$\begingroup$

The question

Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs.

What are known possible attacks (apart from the following example) that could help to decrypt the plaintext without knowing the key?

Does some probability analysis exist for the example attack outlined below?

An example for a possible attack:

By looking at how CBC and CTR are done, one possible attack where the attacker knows a certain number of plaintext blocks would be the following. (Please excuse my probably non-standard notation)

Lets say:

  • CBC(k) is the kth block of the CBC ciphertext
  • CTR(k) is the kth block of the CTR ciphertext
  • CTRIV(k) is the kth block of the CTR counter (before being applied to AES)
  • PLN(k) is the kth block of the plaintext

we know from how AES-CBC works that:

CBC(n)=AES(key, PLN(n) XOR CBC(n-1))

and from how AES-CTR works that:

PLN(m)=CTR(m) XOR AES(key, CTRIV(m))

so it follows that:

For all (m,n) where

PLN(n) XOR CBC(n-1) = CTRIV(m)

the following is true:

PLN(m)=CTR(m) XOR CBC(n)

And because PLN(n) XOR CBC(n-1) is easily calculated and CTRIV(m) is a stream of consecutive numbers the check can be done very fast.

Now, as I understand this: The longer the encrypted content and the more plaintext blocks the attacker already knows, the higher the probability for finding new plaintext blocks, which again help in finding newer ones.

The probability would also rise if additional reencryptions of the plaintext with the same key and random IVs are done, because more CBC(n) and/or CTRIV(m) blocks can be gathered.

$\endgroup$
  • 1
    $\begingroup$ Meanwhile, I found some literature on this. And also a name. As I thought, doing this is highly discouraged via the "key separation principle". Here is a link to a publication: "On the Importance of the Key Separation Principle for Different Modes of Operation" link.springer.com/chapter/10.1007/978-3-540-79104-1_29 $\endgroup$ – Robert Schaffar-Taurok Jun 16 '18 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.