Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mentions these sentences:

So I tried to come up with some chosen-plaintext attacks myself and figured out something interesting: for 1 in 256 keys, applying AES-CFB8 encryption to an all-zero plaintext will result in all-zero ciphertext.


In fact, this property is a bit more general: when an IV consists of only zeroes, there will be one integer 0 ≤ X ≤ 255 for which it holds that a plaintext that starts with n bytes with value X will have a ciphertext that starts with n bytes with value 0. X depends on the encryption key and is randomly distributed.

I did a lot of web searching on this topic, but I couldn't find any explanation or proof related to those sentences.

Could someone point me in the right direction about any article, paper, document or website where mentioned properties are proved?


1 Answer 1


So just to be clear, these are not properties of the CFB8 scheme itself - rather, they exist specifically in the context of this attack due to this issue with how windows uses (..or used) the scheme:

The ComputeNetlogonCredential function, however, defines that this IV is fixed and should always consist of 16 zero bytes. This violates the requirements for using AES-CFB8 securely: its security properties only hold when IVs are random.

Regarding proof of the first claim, this excerpt explains it a bit more clearly:

Because AES is a high-quality cipher with no known statistical biases, you can put in any input and encrypt it with any key, and the chance of each individual bit in the output being zero (or one) is 50%. Every output bit’s value is like a digital coin toss. So the chance of the first output byte being zero is the same as the chance that the first 8 output bits are all zero, which is 50% × 50% × 50% … eight times over (50% is just another way of writing 0.50, which is the same as 1/2). 50%8 is 2-8, or 1/256.

The second claim is an extrapolation from the first and I'm afraid my math skills don't reach that far.

  • $\begingroup$ Thanks @Exci for answer my questions. I'm not fluency in English, so I maybe misuse the word "property". However, I'm looking for any source that prove sentences I posted in my question. I know that IV must be random in order to preserve security properties; but I want to read a prove that support the sentence "for 1 in 256 keys, applying AES-CFB8 encryption to an all-zero plaintext will result in all-zero ciphertext.". Anyway, thank you for your response. $\endgroup$
    – rjlara
    Oct 9, 2020 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.