3 ms·

It should be noted that the attack is not only an attack against a weakened AES, but it is also a chosen-plaintext attack. It is standard in cryptography to an

It should be noted that the attack is not only an attack against a weakened AES, but it is also a chosen-plaintext attack. It is standard in cryptography to analyze ciphers under this kind of attack, which is stronger than normal attacks, because a cipher that resists to a stronger attack will also resist to weaker attacks, so using the strongest possible attack increases the confidence in a cipher. While using the strongest attack for testing a cipher remains the correct method, chosen-plaintext attacks are no longer realistic today, so even when a cipher appears somewhat vulnerable to such attacks that does not imply that it is vulnerable in normal use. The reason is that the modes of operation for ciphers where the base cipher can be attacked with chosen plaintexts are obsolete. The most frequently used modes of operation are now modes like the counter mode (e.g. in AES GCM), where it is impossible to perform a chosen plaintext attack (i.e. where you must trick the victim to encrypt a text that you choose, but in counter mode the cipher only encrypts a sequence of numbers chosen by the intended victim, which cannot be influenced by the attacker).

vessenes 3mo ago
I do not believe that chosen plaintext attacks are obsolete. Any time you have an encrypting oracle setup in which the scheme itself does not require some sort of modification of the plaintext itself, you can reach for a chosen plaintext attack. I believe mitigations are known and can be applied or required in standards, but I don't think it's a 'dead' area of cryptanalytic research -- there's so much devil in the details of implementations around the world for these schemes that it seems almost impossible to imagine.
- adrian_b 3mo ago
  Chosen plaintext attacks can work against things like hashing algorithms. But with methods of encryption like AES GCM or any other based on the counter mode, an encrypting oracle does not encrypt the text provided by the adversary. It encrypts a sequence of numbers that cannot be influenced in any way by the adversary, which is then used as an encryption mask for the text chosen by the adversary. No matter what text is chosen by the adversary, it cannot obtain any other information from the oracle except which was the encryption mask. Therefore, the chosen plaintext attack is converted into a much weaker known plaintext attack, because in the worst case the adversary knows both the initial counter value, i.e. the sequence of numbers, and the encryption mask generated by encrypting that sequence. Only if AES were used in a hashing algorithm, instead of being used for encryption, while using a dedicated hash function for hashing, then AES would be exposed to a chosen plaintext attack, when the adversary would be able to provide the text to be hashed and the oracle would give the hash value. IF AES were used in obsolete modes of operation for encryption, like AES-CBC, then it would be exposed to chosen plaintext attacks.

vessenes 3mo ago

I do not believe that chosen plaintext attacks are obsolete. Any time you have an encrypting oracle setup in which the scheme itself does not require some sort of modification of the plaintext itself, you can reach for a chosen plaintext attack. I believe mitigations are known and can be applied or required in standards, but I don't think it's a 'dead' area of cryptanalytic research -- there's so much devil in the details of implementations around the world for these schemes that it seems almost impossible to imagine.

adrian_b 3mo ago
Chosen plaintext attacks can work against things like hashing algorithms. But with methods of encryption like AES GCM or any other based on the counter mode, an encrypting oracle does not encrypt the text provided by the adversary. It encrypts a sequence of numbers that cannot be influenced in any way by the adversary, which is then used as an encryption mask for the text chosen by the adversary. No matter what text is chosen by the adversary, it cannot obtain any other information from the oracle except which was the encryption mask. Therefore, the chosen plaintext attack is converted into a much weaker known plaintext attack, because in the worst case the adversary knows both the initial counter value, i.e. the sequence of numbers, and the encryption mask generated by encrypting that sequence. Only if AES were used in a hashing algorithm, instead of being used for encryption, while using a dedicated hash function for hashing, then AES would be exposed to a chosen plaintext attack, when the adversary would be able to provide the text to be hashed and the oracle would give the hash value. IF AES were used in obsolete modes of operation for encryption, like AES-CBC, then it would be exposed to chosen plaintext attacks.