# Is it possible to do a known-plaintext attack with this set up of AES CTR mode?

Is it possible to perform a known-plaintext attack to extract the key from AES byte encryption?

The encryption is setup with the following two lines:

ctr = Counter.new(128)
crypt = AES.new(key, AES.MODE_CTR, counter=ctr)


And we have both the plaintext and the ciphertext

• No mode of operation should ever leak the AES key as it is protected by the block cipher itself. If it is leaked then it is because of a faulty protocol or a side channel attack on the block cipher implementation. – Maarten Bodewes Nov 16 '18 at 22:48

## 1 Answer

The answer is simply no;

The known-plaintext attack on AES-CTR mode will reveal the encrypted output of the AES $$c_i = p_i \oplus E_k(ctr+i)$$ $$c_i \oplus p_i = E_k(ctr+i)$$

and since in the counter mode, we know the counter values (input to the AES in CTR mode), we can see this as known-plaintext attack on ECB mode.

The possibility of known-plaintext attack on AES in ECB mode is given lately as;

No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.

• What do you mean? The linked answer says no, but i don't know what $E_k$ is. – Silvia Inden Nov 16 '18 at 21:15
• usually, we writte $AES(key, etc.)$ as $E_k(plaintext)$. Yes, the answer is no. Your writing is coding style. – kelalaka Nov 16 '18 at 21:17