I am reading a book about web security and they are now talking about AES CBC. After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext.
Is this possible? If not why?
Thanks.
After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain text and the ciphertext.
No; or at least, there is no known way to do so.
If there was, well, AES would be considered "broken".
Is this possible? If not why?
Well, the short answer is "a lot of really bright people have tried to come up with a way, and nothing occurred to them".
In AES, the plaintext is processed by the key in a number of steps ("rounds" is the terminology we use), stirring in the key each time. Each step is easy to reverse if you know the key (hence AES is invertible, and so we can decrypt with the key); however the end product (the ciphertext) is a complex function of the key and the plaintext; it certainly isn't an obvious way to figure out what key was used.
Now, there are more advanced strategies that could be used (such as looking at the encryption of similar plaintexts, and see if that gives you information you can't get by looking at isolated plaintext/ciphertext pairs), however AES was specifically designed to foil such advanced strategies (and would appear to be successful in doing so)
