Score:0

Best complexity of guessing some bits of AES-256 outputs

bw flag

Suppose we have a plaintext $m$ and $|m| = 128$. Now suppose we know $l$ bit of the output $AES_k(m) = c$.

What is the best complexity of guessing the rest $128-l$ bits of output with probability at least $\frac{1}{2}$. Note that we don't know the value of $k$

Score:1
sa flag

Haven't even had my morning coffee but thinking aloud and adapting the answer of your related recent question here (comments and corrections welcome, especially about the use of the $\binom{128}{l}$ factor in the answer):

Given $m_1$, $m_2$ and $c_1$ we expect there to be roughly $2^{128}$ 256-bit keys $k$ such that $\mathrm{AES}_k(m_1)=c_1$. These keys are then likely to produce $(1-1/e)2^{128}$ different possible encryptions of $m_2$ of which the most likely value will occur roughly $128/7$ times.

This "most loaded bin value" will actually occur for more than one bin due to the Poisson approximation guiding the bin loads described here. Essentially this allows you to decouple the components and model the load in each bin as being "nearly independent". However, this approximation will break down if you try to apply it to too many bins.

In the original answer the argument was:

At an arbitrary trial, picking $c'_2$ equal to this most popular value and then guessing $c_1\oplus c'_2$ is the most likely to succeed, but the probability of success is about $2^{-124}$.

Here we are allowed to pick $c_2'$ equal to one of $\binom{128}{l}$ values hence our probability of success becomes about $\binom{128}{l} 2^{-124},$ as long as $l$ is not too large to disturb this Poisson heuristic.* I would guess that $l$ must be significantly smaller than $128$ since there are $128$ bits in the ciphertext block, for this heuristic to make sense. Note that due to the projection from $2^{256}$ keys to blocksize $2^{128}$ we obtained the $(1-e^{-1})2^{256-128}$ different possible encryptions in the original argument, so the average load of our balls into bins process is actually $1.$

Note that the original strategy in your first question took work roughly equal to $2^{256}$ AES evaluations. This can be marginally faster by a reduced factor of $\binom{128}{l}$ if we just declare success and quit when we hit one of the "somewhat loaded bins".

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.