> If some of the plaintext bits are known, in theory the unpredictability should decrease. For an extreme example: if all 128 bits of plaintext are known, and a

> If some of the plaintext bits are known, in theory the unpredictability should decrease. For an extreme example: if all 128 bits of plaintext are known, and all 128 bits of ciphertext are also known, there should be a single 128 bit AES key that maps that input to that output, so the entropy left in the key would be zero. This is correct if either: 1. the planet held enough energy to perform a brute-force attack on a 128-bit key (it doesn't: https://en.wikipedia.org/wiki/Landauer%27s_principle https://en.wikipedia.org/wiki/Landauer%27s_principle ) and such an attack could be performed while the protected information was still relevant. Or: 2. You have an algorithmic break on AES that allows the attack to be carried massively more efficiently, enough to make it practical. Cryptographers refer to this situation as 'winning'.