18

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the original block.

Can I get the encryption key, using this information?

Paŭlo Ebermann
  • 22,946
  • 7
  • 82
  • 119
Denis Bezrukov
  • 183
  • 1
  • 1
  • 4

2 Answers2

21

As far as is publicly known, no, you can't.

If you could, that would constitute a practical known-plaintext key recovery attack on AES, and the existence of such an attack would mean that AES would be considered totally insecure by modern cryptographic standards.

If you do figure out how to do that, publish it and you'll be famous. (Or, if you'd prefer money over fame, take it to your local/favorite intelligence agency or organized crime syndicate. But note that this option carries some significant risk, since whoever you sold that information to would now have a considerable interest in preventing you from selling it to anyone else).

One exception to this is the case where the keyspace is (or you suspect it may be) sufficiently small to allow a brute force exhaustive search of it. That could e.g. be the case if the key is derived from a passphrase that may not have been chosen securely (that is, at random from a sufficiently large pool of combinations). In that case — especially if no delibrately slow key derivation function was used to strengthen the key — you could just write some code (or build some hardware) to try all likely passphrases until you find one that gives the correct encryption.

Ilmari Karonen
  • 46,700
  • 5
  • 112
  • 189
10

No for practical definitions of possible, assuming the key was chosen truly randomly, and no side-channel information is available (such as the power-consumption traces of the encrypting device, or the time it took, for many encryptions).

The design of AES strives to be such that the best way to find the key from plaintext-ciphertext examples is to try keys among the $2^{128}$ possible keys. As far as we know this goal is reached for all practical purposes (within a small factor like 4, subject to debate, which we can neglect). If we tested 10 thousands of millions keys per second for a year on a million of millions devices, odds of hitting the right key are less than 1 in a thousand of millions.I've purposely avoided the ambiguous billion.

fgrieu
  • 149,326
  • 13
  • 324
  • 622