Re: [Cfrg] matching AES security

On Thu, Jul 31, 2014 at 7:13 PM, Peter Gutmann
<pgut001@cs.auckland.ac.nz> wrote:
> Johannes Merkle <johannes.merkle@secunet.com> writes:
>>The attack is very simple:
>>- Gather a list of 2^N cipher texts resulting from the _same_ plain text
>>encrypted under 2^N random keys.
>>- For 2^(128-N) randomly chosen (different) keys, encrypt the known plain
>>text and check if the resulting cipher text matches one of the gathered
>>cipher texts
>
> That attack is *conceptually* very simple, in the same way that getting humans
> to Mars is conceptually very simple:
>
> - Build a rocket capable of travelling to Mars and back.
> - Board rocket and fly to Mars.
>
> Practically, though, some of the steps are a bit tricky.

Except that the issue isn't doing 2^128 calculations: it's what you
have when you have only done 2^70 or so calculations.
The relevant paper is http://cr.yp.to/snuffle/bruteforce-20050425.pdf.

Sincerely,
Watson Ladd

>
> Peter.
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin