- $AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
- $\oplus$ is the standard XOR operation.
- $K$ is a constant 128 bits pseudorandom value, which is used as the key for AES operations, unknown to the attacker.
- $A$ is another constant 128 bits pseudorandom value, unknown to the attacker.
- $B$ is a variable 128bits pseudorandom value, unknown to the attacker.
- $C$ is a 128bits value which is known and can be chosen freely by the attacker.
An attacker can:
- Obtain the value of $AES(A, K)$ (which is constant).
- Obtain the value of $AES(B, K)$, for as many different $B$'s as he wants (note that the attacker cannot choose the value of $B$).
- Test if $C = AES(A \oplus B, K)$; he can also obtain the value of $AES(B, K)$ being these 2 $B$'s the same value.
Can the attacker take advantage of this knowledge? For instance, could he guess a value for $C$ that is equal to $AES(A \oplus B, K)$, or recover $K$, $A$ or $B$?