# Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext? [duplicate]

This question already has an answer here:

I am reading a book about web security and they are now talking about AES CBC. After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext.

Is this possible? If not why?

Thanks.

## marked as duplicate by Maarten Bodewes♦ encryption StackExchange.ready(function() { if (StackExchange.options.isMobile) return; $('.dupe-hammer-message-hover:not(.hover-bound)').each(function() { var$hover = $(this).addClass('hover-bound'),$msg = $hover.siblings('.dupe-hammer-message');$hover.hover( function() { $hover.showInfoMessage('', { messageElement:$msg.clone().show(), transient: false, position: { my: 'bottom left', at: 'top center', offsetTop: -7 }, dismissable: false, relativeToBody: true }); }, function() { StackExchange.helpers.removeMessages(); } ); }); }); Jan 5 at 23:35

• I've closed this as a dupe. Although the other question is about ECB, the answer is correct for any mode of operation. If we wouldn't put the question on hold then we'd have to accept any block cipher & block cipher mode of operation pair, and there are quite a few of both of them - and the answer will not differ. – Maarten Bodewes Jan 5 at 23:37

After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext.

No; or at least, there is no known way to do so.

If there was, well, AES would be considered "broken".

Is this possible? If not why?

Well, the short answer is "a lot of really bright people have tried to come up with a way, and nothing occurred to them".

In AES, the plaintext is processed by the key in a number of steps ("rounds" is the terminology we use), stirring in the key each time. Each step is easy to reverse if you know the key (hence AES is invertible, and so we can decrypt with the key); however the end product (the ciphertext) is a complex function of the key and the plaintext; it certainly isn't an obvious way to figure out what key was used.

Now, there are more advanced strategies that could be used (such as looking at the encryption of similar plaintexts, and see if that gives you information you can't get by looking at isolated plaintext/ciphertext pairs), however AES was specifically designed to foil such advanced strategies (and would appear to be successful in doing so)

No, it is not possible to attack AES by known plaintext-ciphertext pairs. AES is known as a secure block cipher and secure block cipher are designed to resists this kind of attacks.

There is no proof for IND-CPA ("indistinguishability") of AES but likely will not have the opposite.

Brute forcing is out of reach now. However, if ever built, AES-128 will be insecure against Quantum computer. Switching AES-256 is recommended.

However, there are padding oracle attacks for CBC mode, as POODLE, note that these attacks are due to padding and not related with the security or insecurity of the cipher.

• This does not address the question of obtaining the key, neither padding oracle attacks for CBC mode or POODLE reveal the key. – zaph Jan 6 at 15:07
• @zaph The first paragraph is the short answer. There is no proof or disproof of CPA security of AES. QC, once built, will break AES-128. Padding oracle attacks were given as additional information for a newbie for CBC mode. Yes, it doesn't mention that the keys are revealed or not, and yes they are not revealed. – kelalaka Jan 6 at 15:43
• The question is: "can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext." – zaph Jan 6 at 16:49