Say an attacker has access to a non-rate-limited API that takes
(IV, data) and outputs
AES-CBC(key, input, data), with the key remaining on the server side. However, the attacker can pass any (valid) IV and data that they want in an attempt to recover the key.
Is there any optimal way to recover the key with such access?