I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.
Regarding the authentication protocol, I made the following observations:
- The plaintext that is being encrypted is always the same. It may be assumed that the plaintext is known by the adversary.
- Deterministic construction is used for the IV. It can be assumed that the IVs are also known by the adversary.
- only two blocks of data are encrypted.
So, the only thing that changes during different runs of the authentication protocol is the IV (but these IVs are known by the adversary).
My intuition tells me that it is not a good idea to always encrypt the same plaintext. I have the feeling that this may leak information about the encryption key?
So, my question is:
- Can the encryption key be compromised if you have enough transcripts of protocol runs?
- How many protocol runs would you need (AES-128-GCM is used)?