Say an attacker has access to a non-rate-limited API that takes (IV, data)
and outputsAES-CBC(key, input, data)
, with the key remaining on the server side. However, the attacker can pass any (valid) IV and data that they want in an attempt to recover the key.
Is there any optimal way to recover the key with such access?