In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2)

If so, can it be solved by just applying for instance a MAC like AES-GCM or an AES-CTR with a SHA256 HMAC?

Intended application: The encryption of a file. Every client having the key can decrypt the file. The encrypted file is handled blindly by a server (without knowing the key) by its SHA256 hash. When a new client is handed over a false key with the hosted file, he should be able to detect it is the wrong key. And not getting any other (noisy) binary from the same encrypted file as a result. Noting that an attacker delivering the false key has access to the original key, the ciphertext and thus also the plaintext.

(The option of identical files being encrypted with different keys should be there. So deterministic encryption is not my intention)

An other possible easy solution I thought of would be to store the hash of the secret key together with the encrypted file on the server and send it to the client to verify. But I actually prefer using a well known out-of-the-box solution, and not something I came up with. Is applying a MAC / HMAC enough to guarantee only one key results in the given ciphertext.

Hope my intention is clear, and someone knowledgeable can point me in the right direction.


1 Answer 1


For basic AES, it is easy to find two keys in this way. Take any $key1$ and $plaintext1$ and compute $c=AES_{key1}(plaintext1)$. Then, take any $key2$ and compute $plaintext2 = AES^{-1}_{key2}(c)$. It follows that $AES_{key1}(plaintext1) = AES_{key2}(plaintext2)$. Having said this, if AES is used in an authenticated encryption mode with a MAC, this may not necessarily be possible. I wish to stress that there is no guarantee that not, and such a thing would need to be proven. In particular, if you did the standard encrypt-then-MAC (with different keys), then this would be vulnerable in exactly the same way, since the "encryption" part is unchanged. Bottom line, this should be possible to achieve, but it's certainly not guaranteed, and often doesn't hold at all.

  • $\begingroup$ Thanks already, this gets me more then half way! I've read more about HMAC and reasoning if I use the same key for it as for the encryption, the key will be included in the hash. H(key || H(key || message)). As long as the hash function is secure, the HMAC can only be generated with the original key. But I don't know if its ok to use the same key. Also I would prefer then AES-GCM performance wise. But I've no clue if my reasoning is correct and also valid for AES-GCM. $\endgroup$
    – Vincent007
    Commented Aug 18, 2020 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.