Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher text forward diffusive properties (i.e. if we change but i in our cipher, plaintext is change for all blocks after that). To make malleability attacks harder, one can chain the cipher texts during encryption on both directions (or implement something similar as in the bitLocker paper).

Does anyone know if there a implementation of pyCrypto that provides a chaining of the cipher texts using both direction?

One way that I thought of solving this was getting the original cipher text, reversing it using python and then feed it to pyCrypto. However, this seemed a little brute force because the whole point of pyCrypto is to take advantage of their C level implementation (while reversing a string would introduce a obvious unfortunate performance hit).

share|improve this question
I would argue strongly against the goal to make malleability attacks harder with modes of operation that provides only confidentiality, like CBC or its derivatives. It is well known and stipulated that CBC,CTR,BitLocker etc. are malleable. If a user does not want that, he must use authenticated encryption modes, either generic (Encrypt-then-MAC) or dedicated (OCB, GCM, EAX, CCM, etc.). It is a bad practice to use confidentiality-only modes (even if they are tuned) for the purpose they are not well suited. – Dmitry Khovratovich Dec 6 '13 at 9:48
If you want non-malleable encryption, there are constructions for doing so (e.g. EME). But be aware that those schemes are only useful in very special cases. In general, they are inappropriate. Also, don't design or tamper with cryptosystems unless you know what you are doing. – K.G. Dec 6 '13 at 14:24
I was still going to use authentication, but I still wanted stuff to be non-malleable if it was possible and it didn't make the security of the message decrease. – Charlie Parker Dec 7 '13 at 19:24
SIV mode might be interesting for you. – CodesInChaos Jul 5 '15 at 13:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.