Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force search? Would this key be unique? (I currently think so)?

The output of round 1 is:

r1out = MIX(SHIFT(SUB(plaintext xor rk0))) xor rk1

with rk0 being the round key of round 0 and rk1 being the round key of round 1. The plaintext as well as r1out is available. Only one sample is available, thus, I assume that I cannot run the algorithm twice (excluding chosen-plaintext etc.).

  • $\begingroup$ Do you have more than one plaintext-ciphertext pairs? Also is this a homework? $\endgroup$ – kelalaka Sep 10 at 17:46
  • $\begingroup$ No, only one plaintext-round1 pair. This is not homework but a question I came across at work. I am doing research on embedded system security, but more on the hardware side. I was able to reduce an AES encryption to a single round via an attack, thus the question. (Of course I could test it with more pairs, however, I am interested in the limits of my possibilities here) $\endgroup$ – J-Kun Sep 10 at 18:23
  • $\begingroup$ you might go into algebraic attack, but the pairs may not enough. $\endgroup$ – kelalaka Sep 10 at 18:37
  • $\begingroup$ Two pairs makes it easy; I can't quite see how it's feasible with one pair $\endgroup$ – poncho Sep 10 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.