Subject: Re: [Cfrg] matching AES security

From: Peter Gutmann <[email-masked]>
Date: Fri, 1 Aug 2014 02:13:40 +0000

Johannes Merkle <[email-masked]> writes:
>The attack is very simple:
>- Gather a list of 2^N cipher texts resulting from the _same_ plain text
>encrypted under 2^N random keys.
>- For 2^(128-N) randomly chosen (different) keys, encrypt the known plain
>text and check if the resulting cipher text matches one of the gathered
>cipher texts

That attack is *conceptually* very simple, in the same way that getting humans
to Mars is conceptually very simple:

- Build a rocket capable of travelling to Mars and back.
- Board rocket and fly to Mars.

Practically, though, some of the steps are a bit tricky.

Peter.

---

From: Andrey Jivsov <[email-masked]>
Date: Thu, 31 Jul 2014 19:26:42 -0700

> Practically, though, some of the steps are a bit tricky.

Besides, a well-designed protocol that uses a block cipher should 
consider including (pseudo)random IVs.

---

From: Watson Ladd <[email-masked]>
Date: Thu, 31 Jul 2014 20:00:22 -0700

> Practically, though, some of the steps are a bit tricky.

Except that the issue isn't doing 2^128 calculations: it's what you
have when you have only done 2^70 or so calculations.
The relevant paper is http://cr.yp.to/snuffle/bruteforce-20050425.pdf.

Sincerely,
Watson Ladd

>
> Peter.
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin