logoalt Hacker News

adrian_byesterday at 5:09 PM0 repliesview on HN

Chosen plaintext attacks can work against things like hashing algorithms.

But with methods of encryption like AES GCM or any other based on the counter mode, an encrypting oracle does not encrypt the text provided by the adversary.

It encrypts a sequence of numbers that cannot be influenced in any way by the adversary, which is then used as an encryption mask for the text chosen by the adversary.

No matter what text is chosen by the adversary, it cannot obtain any other information from the oracle except which was the encryption mask.

Therefore, the chosen plaintext attack is converted into a much weaker known plaintext attack, because in the worst case the adversary knows both the initial counter value, i.e. the sequence of numbers, and the encryption mask generated by encrypting that sequence.

Only if AES were used in a hashing algorithm, instead of being used for encryption, while using a dedicated hash function for hashing, then AES would be exposed to a chosen plaintext attack, when the adversary would be able to provide the text to be hashed and the oracle would give the hash value.

IF AES were used in obsolete modes of operation for encryption, like AES-CBC, then it would be exposed to chosen plaintext attacks.