# Complexity of AES key reconstruction from state 1 output and plaintext

Assuming that I am able to read the plaintext as well as the output of round 1 of an AES-128 encryption: Is it possible (if yes: how?) to obtain the RoundKey with a lower complexity than brute-force search? Would this key be unique? (I currently think so)?

The output of round 1 is:

r1out = MIX(SHIFT(SUB(plaintext xor rk0))) xor rk1


with rk0 being the round key of round 0 and rk1 being the round key of round 1. The plaintext as well as r1out is available. Only one sample is available, thus, I assume that I cannot run the algorithm twice (excluding chosen-plaintext etc.).

• Do you have more than one plaintext-ciphertext pairs? Also is this a homework? – kelalaka Sep 10 '19 at 17:46
• No, only one plaintext-round1 pair. This is not homework but a question I came across at work. I am doing research on embedded system security, but more on the hardware side. I was able to reduce an AES encryption to a single round via an attack, thus the question. (Of course I could test it with more pairs, however, I am interested in the limits of my possibilities here) – J-Kun Sep 10 '19 at 18:23
• you might go into algebraic attack, but the pairs may not enough. – kelalaka Sep 10 '19 at 18:37
• Two pairs makes it easy; I can't quite see how it's feasible with one pair – poncho Sep 10 '19 at 18:51