Imagine I have this:
想象一下,我有这个:
$cdata = AES_256($data, $pass);
AES_256 implements the AES algorithm.
AES_256实现AES算法。
If I know the content of $cdata and the content of $data and also have the AES_256() code, can I reverse engineer and find $pass?
如果我知道$ cdata的内容和$ data的内容,并且还有AES_256()代码,我可以进行反向工程并找到$ pass吗?
9 个解决方案
#1
Simple answer: NO.
简单回答:没有。
This has been tested, and mentioned in the Wiki link.
这已经过测试,并在Wiki链接中提到。
A related-key attack can break up to 9 rounds of 256-bit AES. A chosen-plaintext attack can break 8 rounds of 192- and 256-bit AES, and 7 rounds of 128-bit AES, although the workload is impractical at 2128 - 2119.
相关密钥攻击可以分解为9轮256位AES。选择明文攻击可以打破8轮192和256位AES,以及7轮128位AES,尽管工作量在2128 - 2119是不切实际的。
Or put it another way: you have a better chance of being struck by lighting... on the same day you win the Lottery, than breaking it!
换句话说:你有更好的机会被灯光击中......在你赢得彩票的同一天,而不是打破它!
#2
This is called a known-plaintext attack. A good cipher like AES should be immune to it, as the others explained.
这称为已知明文攻击。正如其他人所解释的那样,像AES这样的好密码应该对它免疫。
#3
If $pass is actually a password and not a 256-bit key, you may be in luck.
如果$ pass实际上是密码而不是256位密钥,那么你可能会很幸运。
While it is far from trivial to perform, a brute-force attack against a normal password is much faster than brute-forcing a 256-bit key.
虽然执行起来远非微不足道,但是对普通密码的暴力攻击比强制执行256位密钥要快得多。
So modify one of the many password-brute-forcing tools, and you have a attack that (depending on the strength of the password) might take weeks to several years - but that is fast compared to 3x10^51 years...
因此,修改众多密码暴力破解工具中的一个,你有一个攻击(取决于密码的强度)可能需要数周到数年 - 但与3x10 ^ 51年相比,这是快速的...
#4
You could brute force it, but it would take a long time. As in decades or even longer. That's the point of encryption algorithms like AES.
你可以蛮力,但这需要很长时间。几十年甚至更长时间。这就是AES这样的加密算法。
#5
Another quote, from Wikipedia:
来自*的另一句话:
AES permits the use of 256-bit keys. Breaking a symmetric 256-bit key by brute force requires 2^128 times more computational power than a 128-bit key. A device that could check a billion billion (10^18) AES keys per second would require about 3 x 10^51 years to exhaust the 256-bit key space.
AES允许使用256位密钥。通过强力破坏对称的256位密钥需要比128位密钥多2 ^ 128倍的计算能力。每秒可以检查数十亿(10 ^ 18)个AES密钥的设备需要大约3 x 10 ^ 51年才能耗尽256位密钥空间。
Brute forcing when you know the original text might be faster but still, 3 x 10^51 years is a long time. Plus there's the problem of probably not having a device that can check a billion billion (10^18) keys/second.
当您知道原始文本可能更快但是仍然是3 x 10 ^ 51年是很长时间。此外,还有一个问题可能是没有一台可以检测数十亿(10 ^ 18)键/秒的设备。
In short: everything is possible, but this is not feasible in the world we are now living in.
简而言之:一切皆有可能,但这在我们现在生活的世界中是不可行的。
#6
AES, like all good crypto algorithms, doesn't rely on security through obscurity.
与所有优秀的加密算法一样,AES不依赖于安全性。
In other words, there are no "secrets" in the code, so you having the code won't help you particularly.
换句话说,代码中没有“秘密”,因此您拥有代码将无法帮助您。
Known plaintext is a separate issue, which I don't know much about so I'll leave that up to the other answerers.
已知的明文是一个单独的问题,我不太了解,所以我会把它留给其他的回答者。
#7
Of course not - the only approach is brute force. Do you really think NIST is so stupid as to choose a cipher that is so easily cracked for a new standard?
当然不是 - 唯一的方法是蛮力。你真的认为NIST是如此愚蠢,以至于选择一个很容易破解新密码的密码吗?
#8
with the power of super computers the time to crash AES encryption with be dramatically shortened.... I heard...
凭借超级计算机的强大功能,大大缩短了AES加密的时间......我听说......
#9
2x2^256 possible combinations is a lot to bruteforce. But bruteforcing is the only way. It would actually take about 3 decades. AES is the best Encryption possible right now I'd say. But that would only take that much time using a CPU. Because GPU's (Graphic Processing Units) are strictly math based, people have been making programs that only use the GPU to crack math based algorithms much more quickly than a CPU could. In other words AES might not last 3 decades. If only eternity codes were possible. Well looks like dynamic encryption may be the only way people can really hide their information in the near future.
2x2 ^ 256种可能的组合对于暴力来说非常重要。但是暴力是唯一的方式。实际上需要大约30年。 AES是现在我能说的最好的加密方式。但这只需要花费很多时间来使用CPU。因为GPU(图形处理单元)是严格基于数学的,所以人们制作的程序只使用GPU来破解基于数学的算法比CPU更快。换句话说,AES可能不会持续30年。如果只有永恒代码是可能的。看起来像动态加密可能是人们在不久的将来真正隐藏其信息的唯一方式。
#1
Simple answer: NO.
简单回答:没有。
This has been tested, and mentioned in the Wiki link.
这已经过测试,并在Wiki链接中提到。
A related-key attack can break up to 9 rounds of 256-bit AES. A chosen-plaintext attack can break 8 rounds of 192- and 256-bit AES, and 7 rounds of 128-bit AES, although the workload is impractical at 2128 - 2119.
相关密钥攻击可以分解为9轮256位AES。选择明文攻击可以打破8轮192和256位AES,以及7轮128位AES,尽管工作量在2128 - 2119是不切实际的。
Or put it another way: you have a better chance of being struck by lighting... on the same day you win the Lottery, than breaking it!
换句话说:你有更好的机会被灯光击中......在你赢得彩票的同一天,而不是打破它!
#2
This is called a known-plaintext attack. A good cipher like AES should be immune to it, as the others explained.
这称为已知明文攻击。正如其他人所解释的那样,像AES这样的好密码应该对它免疫。
#3
If $pass is actually a password and not a 256-bit key, you may be in luck.
如果$ pass实际上是密码而不是256位密钥,那么你可能会很幸运。
While it is far from trivial to perform, a brute-force attack against a normal password is much faster than brute-forcing a 256-bit key.
虽然执行起来远非微不足道,但是对普通密码的暴力攻击比强制执行256位密钥要快得多。
So modify one of the many password-brute-forcing tools, and you have a attack that (depending on the strength of the password) might take weeks to several years - but that is fast compared to 3x10^51 years...
因此,修改众多密码暴力破解工具中的一个,你有一个攻击(取决于密码的强度)可能需要数周到数年 - 但与3x10 ^ 51年相比,这是快速的...
#4
You could brute force it, but it would take a long time. As in decades or even longer. That's the point of encryption algorithms like AES.
你可以蛮力,但这需要很长时间。几十年甚至更长时间。这就是AES这样的加密算法。
#5
Another quote, from Wikipedia:
来自*的另一句话:
AES permits the use of 256-bit keys. Breaking a symmetric 256-bit key by brute force requires 2^128 times more computational power than a 128-bit key. A device that could check a billion billion (10^18) AES keys per second would require about 3 x 10^51 years to exhaust the 256-bit key space.
AES允许使用256位密钥。通过强力破坏对称的256位密钥需要比128位密钥多2 ^ 128倍的计算能力。每秒可以检查数十亿(10 ^ 18)个AES密钥的设备需要大约3 x 10 ^ 51年才能耗尽256位密钥空间。
Brute forcing when you know the original text might be faster but still, 3 x 10^51 years is a long time. Plus there's the problem of probably not having a device that can check a billion billion (10^18) keys/second.
当您知道原始文本可能更快但是仍然是3 x 10 ^ 51年是很长时间。此外,还有一个问题可能是没有一台可以检测数十亿(10 ^ 18)键/秒的设备。
In short: everything is possible, but this is not feasible in the world we are now living in.
简而言之:一切皆有可能,但这在我们现在生活的世界中是不可行的。
#6
AES, like all good crypto algorithms, doesn't rely on security through obscurity.
与所有优秀的加密算法一样,AES不依赖于安全性。
In other words, there are no "secrets" in the code, so you having the code won't help you particularly.
换句话说,代码中没有“秘密”,因此您拥有代码将无法帮助您。
Known plaintext is a separate issue, which I don't know much about so I'll leave that up to the other answerers.
已知的明文是一个单独的问题,我不太了解,所以我会把它留给其他的回答者。
#7
Of course not - the only approach is brute force. Do you really think NIST is so stupid as to choose a cipher that is so easily cracked for a new standard?
当然不是 - 唯一的方法是蛮力。你真的认为NIST是如此愚蠢,以至于选择一个很容易破解新密码的密码吗?
#8
with the power of super computers the time to crash AES encryption with be dramatically shortened.... I heard...
凭借超级计算机的强大功能,大大缩短了AES加密的时间......我听说......
#9
2x2^256 possible combinations is a lot to bruteforce. But bruteforcing is the only way. It would actually take about 3 decades. AES is the best Encryption possible right now I'd say. But that would only take that much time using a CPU. Because GPU's (Graphic Processing Units) are strictly math based, people have been making programs that only use the GPU to crack math based algorithms much more quickly than a CPU could. In other words AES might not last 3 decades. If only eternity codes were possible. Well looks like dynamic encryption may be the only way people can really hide their information in the near future.
2x2 ^ 256种可能的组合对于暴力来说非常重要。但是暴力是唯一的方式。实际上需要大约30年。 AES是现在我能说的最好的加密方式。但这只需要花费很多时间来使用CPU。因为GPU(图形处理单元)是严格基于数学的,所以人们制作的程序只使用GPU来破解基于数学的算法比CPU更快。换句话说,AES可能不会持续30年。如果只有永恒代码是可能的。看起来像动态加密可能是人们在不久的将来真正隐藏其信息的唯一方式。