4

Let $E_{k}(P)$ be the AES-128 function with key $k$ and plaintext $P$, both 128 bits. I want to know if the following property is generally true for AES or if have I stumbled upon a special set of keys:

$$E_{k_1}(E_{k_2}(P)) = E_{k_1}(P) \oplus E_{k_2}(P)$$

forest
  • 15,626
  • 2
  • 49
  • 103
hp2505
  • 43
  • 3

2 Answers2

5

This would be a major weakness. It is false. You are essentially describing a "double AES" method, see question here. It is known that double AES or double DES is not much more difficult to break than the corresponding cipher on its own. The answer to the question shows double AES is no weaker than AES on its own. However your property would open AES up to attacks.

Let's assume your property holds and lets choose $k_1=k_2=0,$ the all zero key. Then this would give $$ E_0(E_0(P)) = E_0(P) \oplus E_0(P) = 0 $$ which would mean that AES is nilpotent (it's square under composition is the identity map) for this key, for any message. This is patently false and would be a major weakness. One reason it is false is that the design of the key schedule with the round constants prevents AES being weak if the input message or key is all zeroes.

kodlu
  • 25,146
  • 2
  • 30
  • 63
2

A similar property holds true for a (synchronous) stream cipher.

So if you got not the block cipher AES, but e.g. "Counter mode AES applied on a single block with fixed initialization vector", you'd have $$E_k(P) = AES_k(I) \oplus P$$ (where $I$ is your initialization vector, e.g. the full 0 plaintext, or any constant, as long as it's the same for each use).

Then you get

$$ \begin{align} E_{k_1}(E_{k_2}(P)) & = AES_{k_1}(C) \oplus (AES_{k_2}(C) \oplus P) \\ & = AES_{k_2}(C) \oplus (AES_{k_1}(C) \oplus P) \\ & = E_{k_2}(E_{k_1}(P)) \end{align} $$ (i.e. chaining is commutative) and you'd also have $$ \begin{align} E_{k_1}(P) \oplus E_{k_2}(P) & = (AES_{k_1}(C)\oplus P) \oplus (AES_{k_2}(C) \oplus P) \\ & = AES_{k_1}(C) \oplus AES_{k_2}(C), \end{align} $$ i.e. the XOR of ciphertexts from the same plaintext is actually independent of that plaintext.

I didn't find a common function which is having your exact property, but there might be some around.

Please verify what actually your "AES" function is. If it's actually the block cipher (also called ECB – electronic code book), then I'd be really interested to see the keys you've used here to get your example.

Paŭlo Ebermann
  • 22,946
  • 7
  • 82
  • 119