Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
4
down vote

favorite












Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



Can I recover that key?



If, how big does the list of plaintext and matching ciphertext have to be to be able to find it in a feasable amount of time (say in 1 or 2 hours)?










share|improve this question









New contributor




Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.























    up vote
    4
    down vote

    favorite












    Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



    Can I recover that key?



    If, how big does the list of plaintext and matching ciphertext have to be to be able to find it in a feasable amount of time (say in 1 or 2 hours)?










    share|improve this question









    New contributor




    Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.





















      up vote
      4
      down vote

      favorite









      up vote
      4
      down vote

      favorite











      Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



      Can I recover that key?



      If, how big does the list of plaintext and matching ciphertext have to be to be able to find it in a feasable amount of time (say in 1 or 2 hours)?










      share|improve this question









      New contributor




      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



      Can I recover that key?



      If, how big does the list of plaintext and matching ciphertext have to be to be able to find it in a feasable amount of time (say in 1 or 2 hours)?







      aes attack known-plaintext-attack ecb






      share|improve this question









      New contributor




      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      share|improve this question









      New contributor




      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      share|improve this question




      share|improve this question








      edited 5 hours ago









      e-sushi

      13.4k860168




      13.4k860168






      New contributor




      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      asked 13 hours ago









      Richard Jones

      241




      241




      New contributor




      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.





      New contributor





      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






      Richard Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.




















          2 Answers
          2






          active

          oldest

          votes

















          up vote
          6
          down vote














          Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



          Can I recover that key?




          No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.






          share|improve this answer










          New contributor




          kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
          Check out our Code of Conduct.
























            up vote
            4
            down vote













            What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^128$ AES operations, today's top computers can reach $2^63$ around one hour.



            In brute-force, the number of elements in your list is not important. The problem is the key-size. You have to check every possible key to match one of your plaintext-ciphertext pair;



            for each k in possible keys
            if E(k,P1) == C1
            testWithSomeOtherPair(k)


            Once you found you can verify with the other plaintext-ciphertext pairs.



            Note: there are other types of attacks (related-key attacks) faster than the brute-force for AES-192 and AES-256 with $2^176$ and $2^99.5$-time, respectively. But they are still infeasible to reach. For AES-128, the fastest known is the Biclique attack with $2^126.2$ and that is still infeasible and in practice, the brute-force may still beat the Biclique attack which requires $2^88$-data and $2^8$-memory. Biclique attack for AES-192 and AES-256 runs with $2^189.7$ and $2^254.4$ computational complexity, respectively.






            share|improve this answer






















            • So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
              – Richard Jones
              12 hours ago











            • Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
              – kelalaka
              12 hours ago










            • @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
              – Clockwork-Muse
              4 hours ago










            Your Answer





            StackExchange.ifUsing("editor", function ()
            return StackExchange.using("mathjaxEditing", function ()
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix)
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            );
            );
            , "mathjax-editing");

            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "281"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );






            Richard Jones is a new contributor. Be nice, and check out our Code of Conduct.









             

            draft saved


            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63883%2fis-it-possible-to-find-the-key-for-aes-ecb-if-i-have-a-list-of-plaintext-and-cor%23new-answer', 'question_page');

            );

            Post as a guest






























            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            6
            down vote














            Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



            Can I recover that key?




            No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.






            share|improve this answer










            New contributor




            kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
            Check out our Code of Conduct.





















              up vote
              6
              down vote














              Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



              Can I recover that key?




              No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.






              share|improve this answer










              New contributor




              kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
              Check out our Code of Conduct.



















                up vote
                6
                down vote










                up vote
                6
                down vote










                Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



                Can I recover that key?




                No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.






                share|improve this answer










                New contributor




                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.










                Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.



                Can I recover that key?




                No. This is what is referred to as a known plaintext attack, and secure block ciphers are designed to prevent exactly this kind of attack. This answer on the Mathematics Stack Exchange goes into more detail about the notion of IND-CPA ("indistinguishability") which AES is conjectured to meet and how that implies that a known plaintext attack is impossible.







                share|improve this answer










                New contributor




                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.









                share|improve this answer



                share|improve this answer








                edited 5 hours ago









                e-sushi

                13.4k860168




                13.4k860168






                New contributor




                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.









                answered 7 hours ago









                kiwidrew

                2236




                2236




                New contributor




                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.





                New contributor





                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.






                kiwidrew is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
                Check out our Code of Conduct.




















                    up vote
                    4
                    down vote













                    What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^128$ AES operations, today's top computers can reach $2^63$ around one hour.



                    In brute-force, the number of elements in your list is not important. The problem is the key-size. You have to check every possible key to match one of your plaintext-ciphertext pair;



                    for each k in possible keys
                    if E(k,P1) == C1
                    testWithSomeOtherPair(k)


                    Once you found you can verify with the other plaintext-ciphertext pairs.



                    Note: there are other types of attacks (related-key attacks) faster than the brute-force for AES-192 and AES-256 with $2^176$ and $2^99.5$-time, respectively. But they are still infeasible to reach. For AES-128, the fastest known is the Biclique attack with $2^126.2$ and that is still infeasible and in practice, the brute-force may still beat the Biclique attack which requires $2^88$-data and $2^8$-memory. Biclique attack for AES-192 and AES-256 runs with $2^189.7$ and $2^254.4$ computational complexity, respectively.






                    share|improve this answer






















                    • So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                      – Richard Jones
                      12 hours ago











                    • Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                      – kelalaka
                      12 hours ago










                    • @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                      – Clockwork-Muse
                      4 hours ago














                    up vote
                    4
                    down vote













                    What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^128$ AES operations, today's top computers can reach $2^63$ around one hour.



                    In brute-force, the number of elements in your list is not important. The problem is the key-size. You have to check every possible key to match one of your plaintext-ciphertext pair;



                    for each k in possible keys
                    if E(k,P1) == C1
                    testWithSomeOtherPair(k)


                    Once you found you can verify with the other plaintext-ciphertext pairs.



                    Note: there are other types of attacks (related-key attacks) faster than the brute-force for AES-192 and AES-256 with $2^176$ and $2^99.5$-time, respectively. But they are still infeasible to reach. For AES-128, the fastest known is the Biclique attack with $2^126.2$ and that is still infeasible and in practice, the brute-force may still beat the Biclique attack which requires $2^88$-data and $2^8$-memory. Biclique attack for AES-192 and AES-256 runs with $2^189.7$ and $2^254.4$ computational complexity, respectively.






                    share|improve this answer






















                    • So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                      – Richard Jones
                      12 hours ago











                    • Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                      – kelalaka
                      12 hours ago










                    • @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                      – Clockwork-Muse
                      4 hours ago












                    up vote
                    4
                    down vote










                    up vote
                    4
                    down vote









                    What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^128$ AES operations, today's top computers can reach $2^63$ around one hour.



                    In brute-force, the number of elements in your list is not important. The problem is the key-size. You have to check every possible key to match one of your plaintext-ciphertext pair;



                    for each k in possible keys
                    if E(k,P1) == C1
                    testWithSomeOtherPair(k)


                    Once you found you can verify with the other plaintext-ciphertext pairs.



                    Note: there are other types of attacks (related-key attacks) faster than the brute-force for AES-192 and AES-256 with $2^176$ and $2^99.5$-time, respectively. But they are still infeasible to reach. For AES-128, the fastest known is the Biclique attack with $2^126.2$ and that is still infeasible and in practice, the brute-force may still beat the Biclique attack which requires $2^88$-data and $2^8$-memory. Biclique attack for AES-192 and AES-256 runs with $2^189.7$ and $2^254.4$ computational complexity, respectively.






                    share|improve this answer














                    What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, you need to execute $2^128$ AES operations, today's top computers can reach $2^63$ around one hour.



                    In brute-force, the number of elements in your list is not important. The problem is the key-size. You have to check every possible key to match one of your plaintext-ciphertext pair;



                    for each k in possible keys
                    if E(k,P1) == C1
                    testWithSomeOtherPair(k)


                    Once you found you can verify with the other plaintext-ciphertext pairs.



                    Note: there are other types of attacks (related-key attacks) faster than the brute-force for AES-192 and AES-256 with $2^176$ and $2^99.5$-time, respectively. But they are still infeasible to reach. For AES-128, the fastest known is the Biclique attack with $2^126.2$ and that is still infeasible and in practice, the brute-force may still beat the Biclique attack which requires $2^88$-data and $2^8$-memory. Biclique attack for AES-192 and AES-256 runs with $2^189.7$ and $2^254.4$ computational complexity, respectively.







                    share|improve this answer














                    share|improve this answer



                    share|improve this answer








                    edited 12 hours ago

























                    answered 13 hours ago









                    kelalaka

                    2,778625




                    2,778625











                    • So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                      – Richard Jones
                      12 hours ago











                    • Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                      – kelalaka
                      12 hours ago










                    • @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                      – Clockwork-Muse
                      4 hours ago
















                    • So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                      – Richard Jones
                      12 hours ago











                    • Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                      – kelalaka
                      12 hours ago










                    • @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                      – Clockwork-Muse
                      4 hours ago















                    So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                    – Richard Jones
                    12 hours ago





                    So even if we have millions of texts and their corresponding ciphertext using our key, it wouldn't help us to find the key?
                    – Richard Jones
                    12 hours ago













                    Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                    – kelalaka
                    12 hours ago




                    Short answer no. For brute-force, you need only a couple of pairs. There are attacks like biclique attack, but that requires $2^126.2$ operations for AES-128. You can find some other attacks at Wikipedia but you will not see they are better than biclique attack.
                    – kelalaka
                    12 hours ago












                    @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                    – Clockwork-Muse
                    4 hours ago




                    @RichardJones - Note that in a straight brute force attack, knowing the plain text is only for verification - that is, knowing the plain text doesn't help in the decryption at all, and probably isn't necessary (an incorrect key is usually going to generate gibberish in at least some part of a sufficient length message).
                    – Clockwork-Muse
                    4 hours ago










                    Richard Jones is a new contributor. Be nice, and check out our Code of Conduct.









                     

                    draft saved


                    draft discarded


















                    Richard Jones is a new contributor. Be nice, and check out our Code of Conduct.












                    Richard Jones is a new contributor. Be nice, and check out our Code of Conduct.











                    Richard Jones is a new contributor. Be nice, and check out our Code of Conduct.













                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f63883%2fis-it-possible-to-find-the-key-for-aes-ecb-if-i-have-a-list-of-plaintext-and-cor%23new-answer', 'question_page');

                    );

                    Post as a guest













































































                    Popular posts from this blog

                    How to check contact read email or not when send email to Individual?

                    Bahrain

                    Postfix configuration issue with fips on centos 7; mailgun relay