# What is the probability of breaking the AES algorithm?

I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES?

• What is the probability of breaking AES?
• How does the round number influence this probability? Do more rounds really help in decreasing this probability?
• What is the contribution of each round towards enhancing the security?
• Please note that a block cipher can be used with several modes of execution. A few examples : ECB (Electronic CodeBook), CBC (Cipher Block Chaining), CTR (CounTeR mode) ... In addition to the AES security itself, the mode you pick up can also have some specific security concerns. – Rerito Mar 27 '13 at 12:59
• You should be orders of magnitude more worried about security being compromised through a flaw in whatever software you're writing, than in it happening through AES being broken. – Stephen Touset Apr 7 '15 at 16:47
• The biclique attack needs $2^{126.1}$ complexity in order to break AES-128 [en.wikipedia.org/wiki/Biclique_attack]. So the probability (allowing active attacks) is slightly smaller than $1/2^{128}.$ Further, Quantum attacks needs $2^{64}$ (but not implemented yet!). – 111 Apr 8 '15 at 13:39

The probability of breaking AES using this method? AES has 128, 192 and 256 bit key variants. Thus if there are $n$ bits in the key, the probability that your guess is correct is $\frac{1}{2^n}$.
• There would be practical attacks against reduced-round AES; e.g. this, claiming an attack against 4 rounds with 4 chosen plaintext using $2^{32}$ effort and moderate memory. Theoretical attacks exist for more rounds, e.g this. Difficulty of attack increases "quickly" with the number of rounds, but it is hard to quantitatively characterize. – fgrieu Mar 26 '13 at 12:36
• The probability of breaking AES is in fact slightly higher than $1/2^n$, as there is an attack on full-round AES. BUT this attack is not much better than brute-force as it requires only slightly less operations and needs a lot of storage ($2^{88}$ Bytes). – SEJPM Apr 7 '15 at 11:29