as mentioned in the title, and read some past discusstion on AES collison here.

it shows it's possible that, AES(k1, m1)=AES(k2, m1)

just wondering what condition those 2 keys need to meet. Thanks.

  • 1
    $\begingroup$ If the question's "AES(k1, m1)=AES(k2, m1)" is as intended, then the title's "at least 6 bytes" should be "16 bytes". Please fix the discrepancy one way or the other. $\endgroup$
    – fgrieu
    Jun 5 at 7:52
  • $\begingroup$ thanks Fgrieu, yes, at first i dont even know whether even 6 bytes are identical is possible or not. after did some readup, i found it was discussed before on AES(k1, m1)=AES(k2, m1). a continuous 6 bytes identical is what i want to achieve, and find out a possible set of keys? is there pattern for those keys? $\endgroup$
    – hunter lic
    Jun 5 at 16:19

AES is (as far as is known) a very good approximation of a Pseudo-Random Permutation. There's no discernible pattern to how keys transform plaintext into ciphertext blocks. If there were, that would be usable in a Known-Plaintext attack to recover the key given some number of plaintext-ciphertext pairs. That would be a massive security break for AES.

AES used in a Mode of Operation, however, can be different. There extra inputs aside from the key and plaintext block are allowed. This could make it easier to find a collision, or it might make it harder (eg Merkle-Damgaard mode turns a block cipher into a collision-resistant hash function).

With only 6 colliding bytes needed it's likely fast enough to simply brute-force two keys.

  • $\begingroup$ Thx SAI. so i believe there is no pattern to follow between the 2 keys which can generate 6 bytes identical ciphertext. i think i will just randam pick a 128 bit key, and use brute-force mechanism to find another key? in my applicaiton, the IV is the same, and requires the first 6 bytes of ciphertext are same. basically this application is to allow info encrypted by different parties (using different keys) recognize each other by comparing the first 6 bytes of the ciphertext. $\endgroup$
    – hunter lic
    Jun 6 at 1:10
  • $\begingroup$ just to add that my plaintext is only 14-16 bytes, i think only 1 cipher block to encrypt, was using AES-CTR operation mode. $\endgroup$
    – hunter lic
    Jun 6 at 1:29
  • 2
    $\begingroup$ You could mention that for the brute-forcing one would use the birthday paradox to get a complexity of about $2^{24.5}$. $\endgroup$
    – j.p.
    Jun 6 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.