2

Is it theoretically possible to find $P$, $K$, and $K^\prime$ such that $E_K(P) = E_{K^\prime}(P)$ where $E$ is AES-128 and $K \ne K^\prime$? I'd imagine this would be infeasible, but is it actually impossible?

Daffy
  • 2,389
  • 17
  • 29
  • 1
    I would not just say that is is possible, but highly probable, that there is a K and K' that result in the same ciphertext for some P – Richie Frame Jan 29 '16 at 21:04
  • 1
    It should even be feasible to find one if you wanted bad enough. You would expect a collision search to require trying about $2^{64}$ keys with a single chosen plaintext. That is similar to the most computationally complex attacks that have been carried out in practice. – otus Jan 29 '16 at 21:29

0 Answers0