The following details are given:

  • Partial Key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX11000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011
  • Initialization Vector: E898EF8E91F8C9B201E6E29DF87EE152
  • Ciphertext Block 1: 14B8D1412766A8520BACE4598F8AFAEE
  • Ciphertext Block 2: 7E687A49015FA6F1B914635325A6361B
  • Ciphertext Block 3: 8AD191394EF79CEC4B5A256313632CD4
  • Ciphertext Block 4: 8BB4D49F3FA7A917CDF02ECCAA8C4765
  • CBC Mode No padding
  • Character set: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890⌴‛~@#$%^&*(){}[]+=-_<>,.?/!:\;’|"
  • Character set info: range [32,127), ASCII encoded, each character is 8 bits

My thinking is that somehow you will need to decrypt each ciphertext block with each of the known 32 bits of the key and work down. The problem is the first ciphertext block has an unmatched key (XXX ...)
So as a result you will get a plain text of all known characters except the first 32 bits.

  • $\begingroup$ @mti2935 yes, the question is easy ( I've missed some parts): Hint: Generate the keys, decrypt and check that the plaintext doesn't include any byte that is not in the character sets. $\endgroup$
    – kelalaka
    Commented Feb 24, 2022 at 19:15
  • $\begingroup$ @kelalaka if I use each ciphertext block with the key block to derive a partial plaintext. It still leaves the first 32 bits of the plaintext and key uknown. Am i on the right path? $\endgroup$
    – user274857
    Commented Feb 24, 2022 at 19:17
  • $\begingroup$ Nope, You have to use CBC mode to decrypt and there is no padding means that the plaintext is the full block size. Decrypt all blocks and test it. Why do you think that 32-bit plaintext? The decryption of a block leaves 128-bit result. Do you know how a block cipher works and what is CBC mode? $\endgroup$
    – kelalaka
    Commented Feb 24, 2022 at 19:21
  • $\begingroup$ @kelalaka Just to be clear what you are saying is I cannot derive a partial plaintext using each partial key and ciphertext block using CBC mode for each decryption? $\endgroup$
    – user274857
    Commented Feb 24, 2022 at 19:40
  • 1
    $\begingroup$ 1) You can only decrypt a full block ( 128-bit for AES) 2) while searching 2) the key is given in bit-string means that you have to find the missing bits of the one 128-bit key. 3) If you want, you can only decrypt the first ciphertext block and test if passes the test then decrypt all and test again. The better decrypt all ciphertext at once and test. If you know some coding you can write this code in a coupe of hours. $\endgroup$
    – kelalaka
    Commented Feb 24, 2022 at 19:47

2 Answers 2


Can one achieve to search 32-bit keyspace?

OpenSSL with AES-NI can operate 61510120 iterations for 64-byte blocks AES-128 in CBC mode per 3 seconds on my machine.

run openssl speed -evp AES128 to see in your machine.

This makes $2^{26}$ keyspace for three seconds. One needs $2^{6} =64*3$ seconds to find the key candidates with good coding.

For your cause create 3 functions;

  • $P = \operatorname{AES-Dec-CBC}(k, IV, C)$ where $C$ is the ciphertext blocks and $P$ is the decrypted plaintext under the current key $k$ of $C$.
  • $k =\operatorname{GetNextCandidateKey(current)}$ This simple increments the current and creates a key $k = current\mathbin\|1100\cdots011$ in the binary form. You need to convert this into binary to fit the standard encryption librarires
  • $b = \operatorname{CheckTheMessage}(P)$. This function gets a plaintext and checks that the bytes are in the range. If not returns 0 else returns 1

Now with these 3 functions;

current = -1

while current < 2^32 do:
    k = GetNextCandidateKey(current)
    P = AES-Dec-CBC(k, IV, C)
    b = CheckTheMessage(P)

    if b == 1

Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?

Sometimes it is possible. Sometimes it is not possible. It depends on how much of the key you already know.

In your case you seem to know all but 33 bits of the key. So, you should be able to brute force it to figure out the rest of the key.

  • $\begingroup$ When brute forcing how do you know when you have found a valid bit of the unknown 33 bits? $\endgroup$
    – user274857
    Commented Feb 24, 2022 at 20:33
  • $\begingroup$ Look at the output of the decryption. For example, if any byte is not in the range you (or your teacher) specified [32,127) you can throw that key away and start trying another.\ $\endgroup$
    – hft
    Commented Feb 25, 2022 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.