15
$\begingroup$

Some background: I am using the MicroChip ATAES132a for hardware encryption/decryption. The ATAES132a is very configurable and can be misconfigured in such a way that the encryption/decryption will be performed using the same nonce. In theory, if the nonce is known I can do an encryption of the plain text and get the same ciphered text result. Based on this, I could possibly try to encrypt the same plain text with the known nonce and compare to the generated ciphered text until I get a match.

For example, in theory my target key could be some thing like this (see below). I would need to calculate every possible key, use the known nonce and the same plain text until I get the same ciphered text result.

const uint8_t g_key0[] = { 0x01, 0x08, 0x0E, 0x91, 0xe2, 0x64, 0x8f, 0x49, 0x0c, 0xe9, 0x80, 0x45, 0x38, 0xb5, 0x85, 0x3f };

This would exploit how the device was configured incorrectly. The ATAES132a does all its encryption with AES in CCM mode. I can perform the attack either on the ATAES132a or on any PC using any standard AES library.

Is this attack plausible using a modern PC?

Improve this question
$\endgroup$
3
  • $\begingroup$ "if the nonce is known I can do an encryption of plain text and get the same ciphered text result" If the nonce is known, you can encrypt null bytes and recover the keystream, and every message that used that nonce is now decrypted $\endgroup$
    – Richie Frame
    Aug 28, 2018 at 10:13
  • $\begingroup$ @RichieFrame How do you recover the keystream? $\endgroup$
    – PhillyNJ
    Aug 28, 2018 at 10:28
  • 1
    $\begingroup$ CCM mode generates a keystream and XORs it with the plaintext. The keystream is based on the key and nonce, if they are fixed, the keystream is always the same. All you need to do is XOR known or chosen plaintext into the matching ciphertext to recover the keystream $\endgroup$
    – Richie Frame
    Aug 29, 2018 at 0:40

1 Answer 1

Reset to default
39
$\begingroup$

Is this attack plausible using a modern PC?

No. For AES-128 (or any secure 128-bit symmetric cipher for that matter), there are $2^{128}$ possible keys. You would have to try on average half of those keys before finding the right one, which is $2^{128}/2=2^{127}$. At $100,000,000$ attempts per second (or around $2^{26}$), it would take around $2^{101}$ second. The universe is around 13.7 billion years old (about $2^{59}$ seconds). So the amount of time it would take you is $2^{42}$ times the age of the universe.

There are other ways you can calculate this, but the end result is the same. See How much would it cost in U.S. dollars to brute force a 256 bit key in a year?.

Finally, the relevant XKCD:

Security

Improve this answer
$\endgroup$
7
  • 5
    $\begingroup$ Might be worth a small sidenote that this of course generalizes to all ciphers with the specific key length; not just AES-128, but any cipher with a 128-bit key. The exact amount of time needed per key (and thus the number of keys testable per second) will vary with the complexity of the key schedule (Blowfish, I'm looking at you), but at the scales we're discussing here, that doesn't really substantially change anything. A few powers of ten more or less won't make any substantial difference. $\endgroup$
    – user
    Aug 27, 2018 at 16:49
  • 2
    $\begingroup$ @MichaelKjörling "this of course generalizes to all ciphers with ... a 128-bit key" - only to symmetric ciphers that are not mathematically broken (yet). RSA needs 2048 to 4096 bits to be secure. $\endgroup$
    – Alexander
    Aug 27, 2018 at 19:41
  • $\begingroup$ @Alexander, agreed, but I'm not sure I understand why you are invoking RSA here. RSA is asymmetric, not symmetric. Maybe a better comparison would be Vigenere. You could have a Vigenere cipher with 128 bit key, but it would not be secure and would be much easier to break. $\endgroup$
    – mikeazo
    Aug 27, 2018 at 19:44
  • $\begingroup$ Good points both mikeazo and @Alexander. In my defense, I was beginning to run out of space in the margin, and I was addressing my comment primarily to mikeazo as a suggestion for an improvement to the answer. $\endgroup$
    – user
    Aug 27, 2018 at 19:48
  • 1
    $\begingroup$ @PaŭloEbermann, I agree, but I wasn't completely sure what the best number would be. Besides, what's a couple of orders of magnitude among friends? $\endgroup$
    – mikeazo
    Aug 28, 2018 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.