# Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $$\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$$ $$\DeclareMathOperator{\E}{E}$$

Suppose that you have access to an oracle that can provide you $$\E(k, m)$$ for any message $$m$$ (so you can obtain the AES-128-ECB encryption of any block with a key that you want to learn).

Obviously, AES-128 is resilient to chosen plaintext normally.

However, what happens if there is another primitive that allows one to perform crypto with the final round key of key expansion (and the equivalent inverse)?

That is, in addition to $$\E(k, m)$$, the adversary has access to $$\E(\KEYEXP(k), m)$$ and $$\E(\KEYEXP^{-1}(k), m)$$ for any $$m$$. (Even more generally, the adversary has access to $$\E(\KEYEXP^n(k), m)$$ and $$\E(\KEYEXP^{-n}(k), m)$$ for all $$n, m$$ and wants to obtain $$k$$.)

Is AES-128 resilient against this, or is key recovery possible?

(For example, if k was equal to all zeroes, then $$\KEYEXP(k)$$ would give the final round key as B4EF5B...)

• Thanks everybody for improving the post, $\TeX$ is a tricky language to learn. And of course welcome, SciresM, you can look at a small guide here – Maarten Bodewes Mar 5 '19 at 12:54
• @MaartenBodewes: ...and MathJax embedded in Markdown even more so. (Apparently they did finally fix the definition leakage bug, at least.) – Ilmari Karonen Mar 5 '19 at 12:59
• I believe you should see the slide attack. – kelalaka Mar 5 '19 at 18:56
• How do you come to find yourself in a situation where the adversary has these powers? – Squeamish Ossifrage Mar 7 '19 at 6:11
• @SqueamishOssifrage I'm looking at the cryptosystem implemented by a commercial security coprocessor, and these are precisely the primitives available. (Well, I can also obtain the encryption of any value by the byte-reverse of any of the keys above, but yeah). The designer of the cryptosystem allows the above primitives + byte-reverse to be used on "secret" values that are usable but not readable, other primitives (such as XOR, AND, etc) are disallowed. So answer is that the cryptosystem's designer thinks the primitives are safe, and it seems less immediately clear to me that they are. – SciresM Mar 7 '19 at 8:51