# Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

I presented our mathematician with an idea:

If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input and the direction (enc/dec) and can see the output, can you mathematically derive the key? How many tests will you have to run to be able to derive the key?

He said he remembers there was a paper that said it will take only $$2^{16}$$ tries to derive the key. Does this paper exist? Dan anybody point me in the right direction?

• This seems like almost a duplicate of Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext and Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair? except that those questions ask about known-plaintext rather than chosen-plaintext attacks. The answers are effectively the same, though. Apr 3 '19 at 10:24
• Only with side channel attacks like power analysis. Otherwise it is infeasible Apr 4 '19 at 0:02
• Any chance this relates to the lack of AES' information theoretic security? 65,536 IO pairings may well completely determine a mathematical model of the interior of the box. Simultaneous equation solving would then theoretically allow key recovery much more readily than brute force. Does this sound familiar at all? Apr 4 '19 at 0:38

Having $$2^{16}$$ chosen-plaintext under one key doesn't help you to extract the AES key. You have to go to the full-brute force to find the key.
For $$t$$ targets, the expected cost breaking one of the $$t$$ keys is $$2^{128}/t$$ and that will be far below $$2^{128}$$. If you have a billion target (~$$2^{30}$$) the cost will be ~$$2^{98}$$ to find one of the target keys.