# Predicting value of E(k,0) for Block cipher with random and secret key

Some mode of operation of block ciphers rely on the fact that E(k,0) is an unpredictable value when k is random and secret (with 0 denoting the all-zero binary string). Why is this a reasonable assumption?

• I would say that specifying just a single zero as ciphertext is really bad practice. Either you should specify $0^{n}$ or indeed $0^{\{n\}}$ to specify a block of zeros of width $n$, just $0$ really doesn't cut it. – Maarten Bodewes Mar 30 '19 at 22:40

A block cipher, according to its design purpose, is assumed to be a pseudorandom permutation. This means when the key $$k$$ is chosen at random, $$E(k,\cdot)$$ can be viewed as a random permutation. Then, $$E(k,0)$$ is indistinguishable from a random value of the block length, hence unpredictable.
If $$\pi$$ is a uniform random permutation of $$\ell$$-bit strings, then $$\pi(0)$$ is a uniform random $$\ell$$-bit string. (Similarly, the string $$(\pi(0), \pi(1))$$ is not uniformly distributedâ€”it excludes the $$2^\ell$$ pairs of the form $$(x, x)$$â€”but it is very close.)
If you have a secure cryptosystem defined in terms of $$\pi(0)$$, and you instantiate it with $$\pi = \operatorname{AES}_k$$ where $$k$$ is a uniform random key, the fact that you're using a uniform random AES permutation instead of a uniform random permutation in general gives the adversary very little advantage in breaking the instantiation of the cryptosystem. So even though $$\operatorname{AES}_k(0)$$ may not have exactly uniform distribution when $$k$$ is uniformly distributed, it is close enough as far as any algorithms we know can discern.