So, AES is more secure than one-time-pad in this case.
No, the one-time pad is perfectly secure, so it cannot be less secure than AES. What's tripping you up is you're not understanding a subtle detail of what perfect secrecy means. People often misunderstand it to mean "the attacker cannot learn what the plaintext is," but in reality it means this:
- No matter how hard they analyze the ciphertext, it cannot help the attacker learn anything more about the plaintext other than what they can figure out through other means.
Take your argument here:
In case of one time pad, as the attacker already knows the initial portion of plaintext and complete cipher text, attacker can just XOR them to get the initial portion of key. Attacker has to use brute force for the remaining key bits.
Here the initial portion of plaintext is something that the attacker learned not by cryptanalysis, but through some other means. So the question is whether analyzing the ciphertext can gain them additional knowledge about the plaintext. And the perfect secrecy of one-time pads tells us that it cannot, because given just the ciphertext and initial portion of plaintext, every possible remaining portion of plaintext is equally likely.
Another way to put this is that given the initial portion of plaintext, analyzing the OTP ciphertext isn't any more effective than just looking at that initial portion of plaintext and guessing how it might continue. Like, if the initial portion says ATTACK AT D, you might guess the full plaintext is likelier to be ATTACK AT DAWN than ATTACK AT DUSK just because dawn attacks are more common than dusk attacks. But no matter how hard you analyze the ciphertext, it won't help to settle this any further.
In course content, answer is given as :
- Both methods are equal. The adversary cannot decrypt the ciphertext in both the methods
I think this answer is wrong, depending how we interpret the question though. A brute-force attack might learn something about the plaintext in the AES scenario; but "might" is a key word there, there's no guarantee.
The idea would be to do this. Given ciphertext $C$ and partial plaintext $P'$ of length $l$ (in bits), go over every possible AES key $K_i$, and:
- Compute $P_i = \mathrm{AES}^{-1}_K(C)$ (the AES decryption of $C$ with key $K_i$);
- If the first $l$ bits of $P_i$ matches $P'$, then add $P_i$ to the set $S$ of candidate plaintexts; otherwise, discard $P_i$.
Now, for the security of AES in this scenario to be the same as one-time-pad, the resulting set $S$ must be of size $2^{128-l}$—the set of candidate decryptions must be the same as the set of all possible 128-bit strings that start with $P'$.
But all it takes for this to fail is that there exist a single collision—a pair of keys $K_1$ and $K_2$ such that $\mathrm{AES}^{-1}_{K_1}(C) = \mathrm{AES}^{-1}_{K_2}(C)$ (i.e., that $C$ decrypts to the same plaintext for both keys). And such collisions are indeed possible. And if there are such collisions, then there will also be "missing" plaintexts in $S$, which the attacker therefore learns are impossible given $C$ and $P'$.
Ultimately the course's question is vague, because it has these problems:
- "Can the attacker decrypt the ciphertext" is a simplistic goal. As I mention above, the sort of goal that cryptography normally contemplates is "can the attacker learn something about the plaintext by analyzing the ciphertext," which may fall short of a full decryption.
- In the AES scenario the question poses, it's possible but not certain that the attacker could rule out some candidate plaintexts. But the question isn't formulated in a way where we know for sure whether to count that as "the attacker can" vs. "the attacker can't."
There's two key certainties here, though:
- The one-time pad is perfectly secure but AES is not.
- Network security textbooks often don't teach cryptography exactly right
