I'm learning about AES, and I haven't been able to find any intuition or justification about why we expect AES to be difficult to break. How can we be confident that there aren't techniques for inferring the plaintext from the ciphertext, much more efficiently than brute-forcing the key? (And to be clear: I'm asking for an intuition, not a proof. I'm aware that we don't really have proof that any encryption scheme is unbreakable).

Many of the public-key protocols I've learned about are grounded in some simple, well-studied problem that we believe is fundamentally difficult. For example:

RSA: We believe RSA is secure because we believe it is fundamentally difficult to factor very large numbers.

Diffie-Hellman: We believe Diffie-Hellman is secure because we believe it is fundamentally difficult to compute the discrete logarithm.

Is there anything equivalent for AES?

  • 2
    Possibly already answered here: crypto.stackexchange.com/questions/10478/… – Joe Jul 20 '17 at 0:51
  • @Joe, yup, you're right. That's a frustrating answer, but I guess it's an answer nonetheless. I didn't know about that particular stack exchange site. So what should I do with this question? Should I delete it? Or can a more high-rep user close it as a duplicate? – Ord Jul 20 '17 at 0:57
  • Hi @Ord. Glad it helps you. I flagged the question to be closed since it will be better suited on the Crypto meta site. Not actually sure if you can just close it on your own, never happened to me before. All the best with your studies! – Joe Jul 20 '17 at 1:06
  • 1
    I don't think the linked thread provides an answer to the question. I find it sensible to ask for an intuitive way to understand the security of AES (since it can't be boiled down to a single equation). My suggestion is that, instead of looking for AES in particular, you might want to research the basic ideas of SP-networks first. – Arminius Jul 20 '17 at 1:19

I disagree with your characterizations about RSA and DHE. We believe they are secure because there are no significant known attacks on modern implementations with reasonable key sizes that cause either to break in practice; it's the same reason we trust AES. No one has published a method to break secure implementations with practical attacks.

We do know that if given an oracle (or sufficiently powerful quantum computer running Shor's algorithm in polynomial time) that factors RSA moduli or solves discrete logs that it would be possible to break RSA and DHE. This doesn't mean there couldn't be an alternative way to break RSA/DHE that doesn't rely on factoring numbers or solving discrete logs.

For instance, there are plenty of ways to break badly designed RSA (e.g., use a low exponent, don't use a secure padding scheme, choose p and q that result in a small d, etc.) and none of these require some advance to break integer factorization.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.