What is the probability that an AES encrypted file, using a wrong password, gets decrypted to something different than the plaintext, but which could still be likely to be interpreted an the true plaintext by the attacker? Example:
- John Doe encrypts a TXT file which only contains the following sentence: "Tomorrow we are going to throw eggs at the president". Encrypted with AES-256-CBC, key derived from a 128-bit password.
- How many other passwords, other than the real one, are going to produce a plaintext containing a meaningful English sentence?
- Would using AES-GCM avoid the problem and make sure that the real password can be distinguished from other plausible passwords that happen to produce a plaintext?
Is it possible to calculate an estimate, or a range of probabilities? I thought of this question while wondering: what's the use of huge keys or passwords, if among those keys there are some that might produce an even more compromising plaintext than the real one? Of course I would suppose the probability of encrypting a picture (say, several KB) with a password and getting a different picture after decryption is extremely low, but when I think of smaller files (like the 52-byte text in the example above) I'm not so sure.