Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose $E_k$$(a, b, c)$ is encryption of values $a, b$ and $c$ with key $k$ through encryption algorithm AES (AES-128) and each $a, b$ and $c$ are 300 bits integer values.

Also Suppose this algorithm in my question situation work in CBC mode.

If $V_1= E_k(a, b, c)$ and $V_2= E_k(c, a, b)$, my questions is: are the two values $V_1$ and $V_2$ equal or not?

share|improve this question
How do you propose to encrypt 900bits of information with AES? AES only encrypts 128bits in one go. Without specifying what mode of operation you mean, this question is not answerable. That said, the answer is "probably no". – figlesquidge Nov 24 '13 at 19:22
Suppose it work in CBC mode – user34221 Nov 24 '13 at 19:24

I'm going to assume that the comma $,$ operator used in your question means 'concatenate' (normally written $a||b||c$). Moreover, I'm assuming that $a,b,c$ are distinct.

In that case, With incredibly high probability, No: $V_1$ and $V_2$ will not be equal.

Think of it this way: if they were equal, then what would $D_k(V_1)$ be? Supposing $V_1=V_2$, we have: $$a||b||c=D_k(E_k(a||b||c))=D_k(V_1)=D_k(V_2)=D_k(E_k(b||a||c))=b||a||c$$

That is, we would have to deduce that $a||b=b||a$ and thus $a=b$.

share|improve this answer
Yes comma , operator is a separator like concatenation ||. – user34221 Nov 24 '13 at 19:41

For AES-128, the block cipher works on 128 bits at a time. Whichever block cipher mode you use (ECB, CBC, CTR, etc.), the encrypting will always be done on 128-bit blocks. The assumption is also made that padding is being used.

Let's assume that $m = (a||b||c)$ and that $m' = (c||a||b)$. That gives us two separate messages, each 900 bits.

Using $V_1=E_k(m)$ and $V_2=E_k(m')$, you can say that $V_1 \neq V_2$.

Depending on the block cipher mode you're using (ex: Electronic Codebook), however, it is quite possible that individual 128-bit cipher blocks may be identical between $m$ and $m'$. For CBC, you should not have identical cipher blocks in this scenario.

*N.B. I've found Practical Cryptography by Niels Ferguson and Bruce Schneier to be a good source of information for researching and answering these sorts of questions.

share|improve this answer
Nice answer. [+1] Btw.: Welcome to Crypto.Se! – e-sushi Nov 25 '13 at 2:06

$V_{1}$ and $V_{2}$ should never be equal when using correct implementation of cbc by using the same input $(a,b,c)$.

See following construction scheme:

cbc scheme wikipedia

Even though you have two distinct encryption processes, namely one for $V_{1}$and another for $V_{2}$, the correct implementation of CBC uses an initialization Vector IV which has to be random. By xoring this random value into the stream, there will never be the same output for same input except using the same IVs. Using those is a very weak point then and should always be avoided.

As you have specified that $V_{1}$ is from input $(a,b,c)$ and $V_{2}$ is from input $(c,a,b)$ this would also not give the same output. For detailed answer see other answers in this post as they have pointed this out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.