Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

Question

I presented our mathematician with an idea:

If you have a black box that encrypts or decrypts AES with the same 128 bit key (you don't have any direct access to the key), and you control the input and the direction (enc/dec) and can see the output, can you mathematically derive the key? How many tests will you have to run to be able to derive the key?

He said he remembers there was a paper that said it will take only $2^{16}$ tries to derive the key. Does this paper exist? Dan anybody point me in the right direction?

This seems like almost a duplicate of Shortcuts / practicality of brute forcing block cipher (AES) + ECB with known plaintext and Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair? except that those questions ask about known-plaintext rather than chosen-plaintext attacks. The answers are effectively the same, though. — Ilmari Karonen, Apr 03 '19 at 10:24
Only with side channel attacks like power analysis. Otherwise it is infeasible — Natanael, Apr 04 '19 at 00:02
Any chance this relates to the lack of AES' information theoretic security? 65,536 IO pairings may well completely determine a mathematical model of the interior of the box. Simultaneous equation solving would then theoretically allow key recovery much more readily than brute force. Does this sound familiar at all? — Paul Uszak, Apr 04 '19 at 00:38

kelalaka · Accepted Answer · 2019-04-06T16:04:02.613

What you describe is Chosen-Plaintext Attack (CPA) and AES and secure block ciphers are designed to be secure against this.

Having $2^{16}$ chosen-plaintext under one key doesn't help you to extract the AES key. You have to go to the full-brute force to find the key.

Since you have one target, you cannot get help from attacking many keys simultaneously. In some cases, the black box may reside in many days in front of you, thus, during those days, you will get many target keys.

For $t$ targets, the expected cost breaking one of the $t$ keys is $2^{128}/t$ and that will be far below $2^{128}$. If you have a billion target (~$2^{30}$) the cost will be ~$2^{98}$ to find one of the target keys.

Is it possible to mathematically extract an AES key from black-box encrypt/decrypt hardware?

1 Answers1