Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force search? Would this key be unique? (I currently think so)?
The output of round 1 is:
r1out = MIX(SHIFT(SUB(plaintext xor rk0))) xor rk1
rk0 being the round key of round 0 and
rk1 being the round key of round 1. The plaintext as well as
r1out is available. Only one sample is available, thus, I assume that I cannot run the algorithm twice (excluding chosen-plaintext etc.).