# How close is AES to random oracle model?

I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it.

Let's say I have a blackbox B which for any input returns either encryption or random data

B(input){
if(hasBeenEncryptedBefore(input)){
fail();
}
with prob. 0.5 returns: "truly random bits from ROM" OR "f(input)"
}


where:

f(input){
IV := randomIV();
key := getKey();
return IV, AES_ENC(IV, key, input);
}


let's assume that getKey() returns the same key for each encyption and randomIV() returns truly random bits from ROM

Is the adversary interacting with B able to determine whether the result comes from ROM or AES?

• AES by itself is a block cipher, or keyed pseudo-random permutation. As such it is deterministic. Are you considering a specific scheme that makes it random? If not, then maybe that's the issue? – Maarten Bodewes Dec 29 '18 at 15:08
• If I'm interacting with blackblox by giving it input and getting in response Truly Random data or encryption of my input with random seeds, would I be able to distinguish in which way blackbox behaves? – wojteo Dec 29 '18 at 15:46
• AES uses a key, not a seed. It is possible to build a secure PRNG, such as DRBG-CTR that does use a seed. If seeded well, it should be indistinguishable from random (well, actually, it might provide a better distribution than most TRNG's). I would link to the DRBG (deterministic random bit generator) but NIST is in government shutdown at the moment. – Maarten Bodewes Dec 29 '18 at 15:55
• I made mistake: by seed I meant randomly generated key. I'm looking for publications that'd describe AES as indistinguishable from random oracle in experiment such as mine – wojteo Dec 29 '18 at 16:02
• Yeah, but if you just use AES - the block cipher - with a single random key then you can just send two identical plaintext blocks to distinguish it from a random oracle. If you use a different random key each time then it will be indistinguishable, but you would need as much key information as required to generate pseudo-random output. That's why you need to use AES in some kind of scheme, which you haven't specified. – Maarten Bodewes Dec 29 '18 at 16:05