Return to Revisions

I wouldn't count on it. AES is rated to withstand cryptanalysis so long as it remains a black box to the attacker (IE:round keys are unknown variables). Thanks to SHA3 competition entries that reuse parts of AES, cryptanalysis has been done on AES as a hash function. I wouldn't rely on raw AES to stop the attacker when they can see the internal state.

Several interesting results have been achieved:

• finding a K such that AESenc(P,K)~=(C) for a given P and C
• similar attacks with constraints on some key bits and imperfect matching of P and C

These attacks tend to use a sort of meet in the middle approach combined with differential cryptanalysis of each round which puts the round key and s-boxes tohether into a super s-box and finds high probability differentials. They are completely practical and make using AES in a typical hash construction role (IE:state[i]=AES(state[i-1],data[i])) completely insecure.

Relying on AES, even with a fixed key as a strong pseudorandom permutation is risky. In your case they have freedom to tamper with input bits and freedom to tamper with some output bits. That could be enough.