1
$\begingroup$

I have currently a problem which I am unable to solve.

I want to implement an attack on AES after 3 rounds without the mix columns on the 3rd.

The goal is from the last round to guess the value of each key byte of the last round key separately. So with my ciphertext (chosen by me), I should be able to guess the last round key. From that I can recover the master key using the inverse key expansion.

I tried to create a plaintext using a matrix with only the first block with values (from 0 to 255) and the remaining blocks equal to a constant -0,1,....

But after that I don't know really know how to do from the cypher text to guess byte by byte the key. Correct me if I am wrong, but I think that every cipher text byte XORed with a value x (that I would have to bruteforce) would give me a 0 if it is the correct x ? I have everything coded in C language. I have functions calculating the next round of AES (mix with key, shift row, mix columns and subbyte), functions to encrypt, decrypt and so on.

Thank you in advance

$\endgroup$
1
$\begingroup$

This is not really an AES question. Any binary vector $x$ of any length (length 8 for byte) has the property that its’ XOR with $y$, i.e., $$x \oplus y=0$$ if and only if $x=y$. This is because addition and subtraction of individual bits are the same modulo 2.

So the answer to your question is yes.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.