Re: [Cfrg] matching AES security

[Andrey Jivsov <[e-mail]>]

On 07/31/2014 07:13 PM, Peter Gutmann wrote:
> Johannes Merkle <[e-mail]> writes:
>> The attack is very simple:
>> - Gather a list of 2^N cipher texts resulting from the _same_ plain text
>> encrypted under 2^N random keys.
>> - For 2^(128-N) randomly chosen (different) keys, encrypt the known plain
>> text and check if the resulting cipher text matches one of the gathered
>> cipher texts
> That attack is *conceptually* very simple, in the same way that getting humans
> to Mars is conceptually very simple:
>
> - Build a rocket capable of travelling to Mars and back.
> - Board rocket and fly to Mars.
>
> Practically, though, some of the steps are a bit tricky.
>
> Peter.
>

Besides, a well-designed protocol that uses a block cipher should 
consider including (pseudo)random IVs.