Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption?

The encryption is setup with the following two lines:

ctr = Counter.new(128)
crypt = AES.new(key, AES.MODE_CTR, counter=ctr)

And we have both the plaintext and the ciphertext

  • $\begingroup$ No mode of operation should ever leak the AES key as it is protected by the block cipher itself. If it is leaked then it is because of a faulty protocol or a side channel attack on the block cipher implementation. $\endgroup$
    – Maarten Bodewes
    Commented Nov 16, 2018 at 22:48

1 Answer 1


The answer is simply no;

The known-plaintext attack on AES-CTR mode will reveal the encrypted output of the AES $$c_i = p_i \oplus E_k(ctr+i)$$ $$ c_i \oplus p_i = E_k(ctr+i)$$

and since in the counter mode, we know the counter values (input to the AES in CTR mode), we can see this as known-plaintext attack on ECB mode.

The possibility of known-plaintext attack on AES in ECB mode is given lately as;

No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.

  • $\begingroup$ What do you mean? The linked answer says no, but i don't know what $E_k$ is. $\endgroup$ Commented Nov 16, 2018 at 21:15
  • $\begingroup$ usually, we writte $AES(key, etc.)$ as $E_k(plaintext)$. Yes, the answer is no. Your writing is coding style. $\endgroup$
    – kelalaka
    Commented Nov 16, 2018 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.