Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0?

Question

I'm brute forcing a ciphertext with a given dictionary to figure out which key was used. However, it's been hinted at that there is a way to narrow down the dictionary to a smaller subset of possibilities.

I know the plaintext, its ciphertext, and the IV (0). It was encrypted using AES-128-CBC and no salting was used during encryption.

At first I thought I was onto something because of: $C_j = E_k(P_j \oplus IV)=E_k(P_j)$ for IV = 0. But I was dead in my tracks right after. Is this situation even plausible or am I barking up the wrong tree?

CBC mode doesn't use a salt. Password based key derivation often uses a salt. Now a password may well be vulnerable against e.g. dictionary attacks. — Maarten Bodewes, Oct 19 '19 at 03:32
Funny, I could not find a direct dupe, but this one might come close or be a dupe... — Maarten Bodewes, Oct 19 '19 at 03:35
Modern block ciphers like AES are resistant to key recovery attack. Maybe post the original homework text so that we can find out what exactly is being hinted? — DannyNiu, Oct 19 '19 at 05:16

score 3 · Answer 1 · answered Oct 19 '19 at 03:31

Very simple, attacks on the block cipher mode of operation do not translate to attacks on the block cipher itself. The block cipher is simply a component within the mode of operation after all.

The only time where the block cipher may come under attack is if the key is somehow changed to a related key in the scheme. This is somewhat of an issue for AES-256 if it is used as component for a secure hash algorithm, where the key schedule becomes an issue. That has absolutely nothing to do with CBC mode for a particular key as in your question.

AES, as a block cipher, is supposed to be not vulnerable against known plaintext attacks. As such, the key cannot be found by knowing any information about the plaintext. So you are indeed dead in your tracks.

Is it possible to narrow down the possible keys used for AES CBC encryption, knowing a given plaintext and its ciphertext, where IV=0?

1 Answers1