I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware of the typical tests to carry out to check for weak implementations. For instance, with DES you can test for use of weak/semi-weak keys, with RSA you can test for lack of padding etc etc, but as far I know there aren't options like this with AES. Where could I possibly begin looking for a bad implementation?

  • $\begingroup$ Rather than asking a broad question, you can ask hints for your CTF. We have CTF tag . $\endgroup$ – kelalaka Apr 7 '19 at 18:20
  • $\begingroup$ I've added an 'attack' tag which is what came up for CTF, but there isn't really much info to add around the CTF itself other than it's from hackthebox - it's literally just a cipher text that you're meant to crack. The challenge is called 'keys'. $\endgroup$ – muke Apr 7 '19 at 18:22
  • $\begingroup$ Looking for weak AES is an act of futility. If there are any weaknesses they are problably time related side channel attacks. But it is much more likely that the application of AES is not secure, e.g. that CBC padding oracles apply. Actually attacking AES should be rather unlikely for a CTF... $\endgroup$ – Maarten Bodewes Apr 8 '19 at 9:05

Browse other questions tagged or ask your own question.