I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it.
Let's say I have a blackbox B which for any input returns either encryption or random data
B(input){
if(hasBeenEncryptedBefore(input)){
fail();
}
with prob. 0.5 returns: "truly random bits from ROM" OR "f(input)"
}
where:
f(input){
IV := randomIV();
key := getKey();
return IV, AES_ENC(IV, key, input);
}
let's assume that getKey() returns the same key for each encyption and randomIV() returns truly random bits from ROM
Is the adversary interacting with B able to determine whether the result comes from ROM or AES?