I do many searches but can't find any explanation about "AES analysis using entropy" I found this scenario in CRYPTOOL2 templates but there is no explanation how entropy is used. There is just a short description &quot;This template shows how to use a brute-force search to attack an AES-encrypted text. The Keysearcher component searches a subspace of the AES keyspace and uses the entropy of the decrypted plaintexts to find the correct one.
The plaintext with the lowest entropy will rank first in the bestlist.
As input, the Keysearcher receives a ciphertext, which was entered hex-encoded.&quot;
What does &quot;and uses the entropy of the decrypted plaintexts to find the correct one.&quot; mean here?
Natural language has a nonuniform distribution. If a character $x$ appears $N_x$ times in a candidate decryption with $N$ characters, the sample entropy estimate will be
$$
\sum_{x \in X} (N_x/N) \log (N/N_x)
$$
by Shannon’s formula, where $X$ is the set of characters.
If the decryption is incorrect (wrong key guess) this value will be high, nearly equal to the maximum of $N \log |X|$ due to the fact that a wrong decryption results in random nearly uniform characters.
If $N$ is large enough and the message is in a natural language, it is very likely that the decryption with the lowest entropy is the one with the right key guess.
The cryptool site points to a help functionality but it seems that you need to download the package, the entropy reference does not appear in the online version.
Edit: So, this approach would only work in ECB (Electronic Codebook) mode for AES since it fails Ind-CPA. This basically means that the plaintext is divided into blocks 128 bits long, with no padding or randomized padding. Therefore the plaintext characters are distributed according to, say English, and have low entropy.