# AES-CTR key reuse attack with same IV and known plain text [duplicate]

this is from an IT Security exercise which my friend and me cannot solve.

Given

• 2 AES-CTR stream-cipher encrypted files
• Same known initalizing vector
• Same (unkown) key
• Same 128bit Counter initialized with 0
• Files are .png so there is known plain text in both files (the file header)

Our approach was to use the known equivalence of

$$E(A) \oplus E(B) = A \oplus B$$

From there the only option we see is to brute force $$A$$ and $$B$$ for the known $$\oplus$$ product.

Is there a smarter way to get $$A$$, $$B$$? Thanks for any hints!

• Possible duplicate of Why must IV/key-pairs not be reused in CTR mode? That is two-time pad. – kelalaka Nov 29 '19 at 17:12
• I agree, because there aren't any other mathematical equivalences to work with, so you are left guessing the bit values within $A$ and $B$ (not sure if you'd call that brute force though). How to do that depends on the type of message - in this case PNG pixels. That you have the header doesn't make it any easier. – Maarten Bodewes Nov 29 '19 at 17:40
• Comment below if you have a generic method of getting the original values within PNG files that are XOR'ed together. Happy to reopen for that. – Maarten Bodewes Nov 29 '19 at 17:41