8 ms·

Learn How to Break AES

179 points by baby 2y ago

Retr0id 2y ago
Neat, I'm looking forward to the Differential Cryptanalysis portion! It's something I've tried to learn in the past but I've been struggling to find approachable resources.
oulipo 2y ago
Cool! Would be nice to also include side-channel attacks
- tptacek 2y ago
  Side channels aren't block cipher cryptanalysis. There's some very basic side channel stuff in Cryptopals, but modern side channel analysis is primarily microarchitectural, which is a significant change in focus, and someone should do a standalone resource on that.
  - Retr0id 2y ago
    That's not true, there are plenty of side-channel attacks that fall squarely within the realm of block cipher cryptanalysis. Examples include Differential Fault Analysis (DFA), Correlation Power Analysis (CPA) and more. It's true that practical side-channel leaks on software block cipher implementations tend to be microarchitectural (e.g. cache timing), but that's only because the "easier" attacks are already mitigated or considered out of scope (e.g. no physical access).
    - tptacek 2y ago
      Eh, fair enough. Something like differential fault analysis would make a lot of sense in a block cipher cryptanalysis sequence.
  - oulipo 2y ago
    Well it's very connected, you're using the knowledge about block cipher to attack them, even though it's not the "pure mathematical attack", it's still the most widespread attack against current cryptographic systems
- Retr0id 2y ago
  I recently did a CTF challenge write-up for an AES timing side-channel, which I tried to make similarly approachable: https://www.da.vidbuchanan.co.uk/blog/uoftctf-timed-aes.html https://www.da.vidbuchanan.co.uk/blog/uoftctf-timed-aes.html It's not quite the same "lab exercises" format but the CTF challenge files are public, so you can try it for yourself.
alabhyajindal 2y ago
This looks very nice! Thank you! I'm currently taking Cryptography at university and I find the resources online to be quite scarce. I mostly find myself reading Wikipedia. I don't know if I'm missing some background knowledge but some of the math notations tend to be quite difficult to understand. I have spent around 10 hours trying to understand Differential Cryptanalysis unsuccessfully!
- zelphirkalt 2y ago
  Yeah when it comes to math Wikipedia is rarely a good introduction to any topic. Maybe if one studied mathematics before or something, but definitely not for most other people.
  - baby 2y ago
    that's really a shame actually, I think many people try to use wikipedia for Math and it's almost never a good idea
- __alexander 2y ago
  If you haven’t seen it already, check out “Understanding Cryptography: A Textbook for Students and Practitioners”. Probably one of the best and approachable books on cryptography. Plus all the lectures are on YouTube so you can read a chapter and then watch the lecture. Also with the math notation, you a take a photo of it and ask ChatGPT to try to explain it.
  - alabhyajindal 2y ago
    Thank you! I'll take a look! Yes, I agree with the suggestion on math notation - I should start doing that.
    - binwiederhier 2y ago
      I can highly recommend Cryptography Engineering by Bruce Schneier. I read it years ago and to this day it still helps me regularly.
MontagFTB 2y ago
If you're interested in this sort of thing, I cannot recommend the cryptopals crypto challenges enough. They are a series of project that take you from XOR up through breaking AES and beyond: https://cryptopals.com/ https://cryptopals.com/
- cinntaile 2y ago
  You also have https://cryptohack.org/ https://cryptohack.org/
- deleted 2y ago
  [deleted]
- secret-noun 2y ago
  The writing of Cryptopals is unclear. I've made it about half-way through the challenges twice over the past decade. I get that it's prompting me to learn on my own, as if I was a real cryptanalyst encountering a system for the first time, but I literally do not understand what is being asked or the constraints of the problems sometimes. It's like author is trying to be clever and curt and gate-keeper-y on purpose. "You should be able to do this with a shitty, hastily-written problem description, right?"
  - tptacek 2y ago
    We ran these challenges at Matasano with the public, under a system where you could only get the next 8 challenges after demonstrating that you'd solved the previous 8, after I wrote an internal guide for our consultants on the cryptographic vulnerabilities they should be capable of addressing on engagements. What you're reading there is basically an internal README. They got very popular (many, many people have solved all of them without additional prompting), but we didn't really invest any extra time in cleaning them up or refining their pedagogy.
    - thenewwazoo 2y ago
      …and thank you (all) for doing so. It’s my go-to motivation when teaching Rust to experienced programmers. It’s a raging success every time.
underdeserver 2y ago
Just in case anyone's wondering, AES - the regular AES-128, 192 or 256 - is not publicly broken (yet).
- tialaramex 2y ago
  In fact it is IMO unlikely this primitive will ever be broken. Its predecessor, DES was "broken" only in the sense that it was intended to be possible to break it with enough computing power when it shipped, as a NOBUS (Nobody But Us can break it) by the US government. In 1975 this is a NOBUS, in 2025 it's basically saying "Please hack us China" so we don't do that any more. Although cryptanalysis of DES did reveal some flaws, the actual breaks, including ones you'd use today if tasked to break DES at scale, all target exactly the two deliberately chosen weaknesses from when it was designed 50 years ago - its keys are too small and its block sizes are too short, that's all, and that's enough. In AES neither of these flaws is present, hence I am not alone in thinking we probably won't ever build another one. You might think well, in 50 years we'll have better computers so that's dumb. Nope. Unless there's an actual mathematical break what runs out isn't mere human ingenuity, it's plain physics.
  - randomtoast 2y ago
    Grovers algorithm can brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations (on a quantum computer which we likely have in 50 years), instead of 2^128. Now, lets find another attack vector (maybe with the help of AI) that reduces the 64 a bit and you are in the realm of feasibility.
    - metacritic12 2y ago
      But everyone will upgrade to AES-256 (many system already has), and that truly will be the final symmetric algo even with moore's law.
      - hinkley 2y ago
        MD-5 died the same way. We had to scare people into investing into upgrading to SHA-1 by showing them the slope of hardware and the variability in new breakthroughs and ask if they'd rather have an emergency that lasted for over a month or work it into the schedule among the other requirements now? Yes, people can upgrade but nobody fucking will until you impress upon them how stupid they're being by gambling the entire company on carrying that debt for another year.
tptacek 2y ago
David Wong hasn't been at NCC Cryptography for a long time, so I assume we'll be waiting a long time before we get to Linear and Differential cryptanalysis, but if that's a thing you're interested in, what you want is the Heys tutorial: http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf My recommendation: print it out to a PDF with huge margins so you can make notes, and then work through all the worked examples.
- pbsd 2y ago
  Interestingly enough, the Square attack (otherwise more generally known as integral cryptanalysis) is much more powerful than regular linear or differential cryptanalysis when applied to the AES.
- baby 2y ago
  I'm actually looking for an intern to reboot this project :) if anybody is interested https://blog.zksecurity.xyz/posts/internship-2025/ https://blog.zksecurity.xyz/posts/internship-2025/

179 points by baby 2y ago

Neat, I'm looking forward to the Differential Cryptanalysis portion! It's something I've tried to learn in the past but I've been struggling to find approachable resources.

oulipo 2y ago

Cool! Would be nice to also include side-channel attacks

tptacek 2y ago
Side channels aren't block cipher cryptanalysis. There's some very basic side channel stuff in Cryptopals, but modern side channel analysis is primarily microarchitectural, which is a significant change in focus, and someone should do a standalone resource on that.
- Retr0id 2y ago
  That's not true, there are plenty of side-channel attacks that fall squarely within the realm of block cipher cryptanalysis. Examples include Differential Fault Analysis (DFA), Correlation Power Analysis (CPA) and more. It's true that practical side-channel leaks on software block cipher implementations tend to be microarchitectural (e.g. cache timing), but that's only because the "easier" attacks are already mitigated or considered out of scope (e.g. no physical access).
  - tptacek 2y ago
    Eh, fair enough. Something like differential fault analysis would make a lot of sense in a block cipher cryptanalysis sequence.
- oulipo 2y ago
  Well it's very connected, you're using the knowledge about block cipher to attack them, even though it's not the "pure mathematical attack", it's still the most widespread attack against current cryptographic systems
Retr0id 2y ago
I recently did a CTF challenge write-up for an AES timing side-channel, which I tried to make similarly approachable: https://www.da.vidbuchanan.co.uk/blog/uoftctf-timed-aes.html https://www.da.vidbuchanan.co.uk/blog/uoftctf-timed-aes.html It's not quite the same "lab exercises" format but the CTF challenge files are public, so you can try it for yourself.

alabhyajindal 2y ago

This looks very nice! Thank you! I'm currently taking Cryptography at university and I find the resources online to be quite scarce. I mostly find myself reading Wikipedia. I don't know if I'm missing some background knowledge but some of the math notations tend to be quite difficult to understand. I have spent around 10 hours trying to understand Differential Cryptanalysis unsuccessfully!

zelphirkalt 2y ago
Yeah when it comes to math Wikipedia is rarely a good introduction to any topic. Maybe if one studied mathematics before or something, but definitely not for most other people.
- baby 2y ago
  that's really a shame actually, I think many people try to use wikipedia for Math and it's almost never a good idea
__alexander 2y ago
If you haven’t seen it already, check out “Understanding Cryptography: A Textbook for Students and Practitioners”. Probably one of the best and approachable books on cryptography. Plus all the lectures are on YouTube so you can read a chapter and then watch the lecture. Also with the math notation, you a take a photo of it and ask ChatGPT to try to explain it.
- alabhyajindal 2y ago
  Thank you! I'll take a look! Yes, I agree with the suggestion on math notation - I should start doing that.
  - binwiederhier 2y ago
    I can highly recommend Cryptography Engineering by Bruce Schneier. I read it years ago and to this day it still helps me regularly.

MontagFTB 2y ago

If you're interested in this sort of thing, I cannot recommend the cryptopals crypto challenges enough. They are a series of project that take you from XOR up through breaking AES and beyond: https://cryptopals.com/ https://cryptopals.com/

cinntaile 2y ago
You also have https://cryptohack.org/ https://cryptohack.org/
deleted 2y ago
[deleted]
secret-noun 2y ago
The writing of Cryptopals is unclear. I've made it about half-way through the challenges twice over the past decade. I get that it's prompting me to learn on my own, as if I was a real cryptanalyst encountering a system for the first time, but I literally do not understand what is being asked or the constraints of the problems sometimes. It's like author is trying to be clever and curt and gate-keeper-y on purpose. "You should be able to do this with a shitty, hastily-written problem description, right?"
- tptacek 2y ago
  We ran these challenges at Matasano with the public, under a system where you could only get the next 8 challenges after demonstrating that you'd solved the previous 8, after I wrote an internal guide for our consultants on the cryptographic vulnerabilities they should be capable of addressing on engagements. What you're reading there is basically an internal README. They got very popular (many, many people have solved all of them without additional prompting), but we didn't really invest any extra time in cleaning them up or refining their pedagogy.
  - thenewwazoo 2y ago
    …and thank you (all) for doing so. It’s my go-to motivation when teaching Rust to experienced programmers. It’s a raging success every time.

underdeserver 2y ago

Just in case anyone's wondering, AES - the regular AES-128, 192 or 256 - is not publicly broken (yet).

tialaramex 2y ago
In fact it is IMO unlikely this primitive will ever be broken. Its predecessor, DES was "broken" only in the sense that it was intended to be possible to break it with enough computing power when it shipped, as a NOBUS (Nobody But Us can break it) by the US government. In 1975 this is a NOBUS, in 2025 it's basically saying "Please hack us China" so we don't do that any more. Although cryptanalysis of DES did reveal some flaws, the actual breaks, including ones you'd use today if tasked to break DES at scale, all target exactly the two deliberately chosen weaknesses from when it was designed 50 years ago - its keys are too small and its block sizes are too short, that's all, and that's enough. In AES neither of these flaws is present, hence I am not alone in thinking we probably won't ever build another one. You might think well, in 50 years we'll have better computers so that's dumb. Nope. Unless there's an actual mathematical break what runs out isn't mere human ingenuity, it's plain physics.
- randomtoast 2y ago
  Grovers algorithm can brute-force a 128-bit symmetric cryptographic key in roughly 2^64 iterations (on a quantum computer which we likely have in 50 years), instead of 2^128. Now, lets find another attack vector (maybe with the help of AI) that reduces the 64 a bit and you are in the realm of feasibility.
  - metacritic12 2y ago
    But everyone will upgrade to AES-256 (many system already has), and that truly will be the final symmetric algo even with moore's law.
    - hinkley 2y ago
      MD-5 died the same way. We had to scare people into investing into upgrading to SHA-1 by showing them the slope of hardware and the variability in new breakthroughs and ask if they'd rather have an emergency that lasted for over a month or work it into the schedule among the other requirements now? Yes, people can upgrade but nobody fucking will until you impress upon them how stupid they're being by gambling the entire company on carrying that debt for another year.

tptacek 2y ago

David Wong hasn't been at NCC Cryptography for a long time, so I assume we'll be waiting a long time before we get to Linear and Differential cryptanalysis, but if that's a thing you're interested in, what you want is the Heys tutorial: http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf http://www.cs.bc.edu/~straubin/crypto2017/heys.pdf My recommendation: print it out to a PDF with huge margins so you can make notes, and then work through all the worked examples.

pbsd 2y ago
Interestingly enough, the Square attack (otherwise more generally known as integral cryptanalysis) is much more powerful than regular linear or differential cryptanalysis when applied to the AES.
baby 2y ago
I'm actually looking for an intern to reboot this project :) if anybody is interested https://blog.zksecurity.xyz/posts/internship-2025/ https://blog.zksecurity.xyz/posts/internship-2025/