Security of a custom AES-based attack model

Question

Provided that:

• $AES(plaintext, key)$ is the standard AES block cipher for a 128 bits block.
• $\oplus$ is the standard XOR operation.
• $K$ is a constant 128 bits pseudorandom value, which is used as the key for AES operations, unknown to the attacker.
• $A$ is another constant 128 bits pseudorandom value, unknown to the attacker.
• $B$ is a variable 128bits pseudorandom value, unknown to the attacker.
• $C$ is a 128bits value which is known and can be chosen freely by the attacker.

An attacker can:

• Obtain the value of $AES(A, K)$ (which is constant).
• Obtain the value of $AES(B, K)$, for as many different $B$'s as he wants (note that the attacker cannot choose the value of $B$).
• Test if $C = AES(A \oplus B, K)$; he can also obtain the value of $AES(B, K)$ being these 2 $B$'s the same value.

Can the attacker take advantage of this knowledge? For instance, could he guess a value for $C$ that is equal to $AES(A \oplus B, K)$, or recover $K$, $A$ or $B$?

Answer 1

I'm guessing from your description that you are describing a mode of operation where $A$ is the message and $B$ is an IV/nonce for a specific block. However you seem to have made an exception where the attacker can know the ciphertext both with and without the $B$ involved. As such, you have a rather weird use of the cipher. To generalize to an arbitrary block cipher:

• $ENC(A, K)$ reveals the ECB mode ciphertext
• $ENC(B, K)$ reveals the uniqueness of $B$
• $ENC(A \oplus B, K)$ reveals the ciphertext using a proper mode of operation.

As such, you essentially have an overcomplicated ECB mode with random inputs. The value $B$ becomes irrelevant to an attacker knowing $ENC(A, K)$. If an attacker needs to find $B$, however they can use the same ECB breaking since they also know $ENC(B, K)$.

This system is strengthened by the fact that $A$ and $B$ are both pseudo-randomly generated (hopefully in a secure manner), and as such normal attempts to break ECB would be useless. Your system also is indistinguishable from random for any number of encrypted blocks, since your input is actually random.

With your system it is impossible, assuming you use a secure encryption algorithm (AES is generally accepted to be secure) to obtain any useful information about the inputs faster than brute-force, even with ECB mode; except in the case of repeating inputs, at which point statistical analysis becomes possible. But for random inputs no statistical analysis is possible.

The only issue I see with this model is the sketchiness of your system - why would your system ever need to reveal $ENC(A, K)$, $ENC(B, K)$ and $ENC(A \oplus B, K)$? I'll leave that for you to decide.

I'm thinking you mean a kind of OTP where $A$ and $K$ make a private key used to generate authentication codes verified by a server also knowing $A$ and $K$... It doesn't really matter, I'm just trying to see if I can guess your intentions.