AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

2
votes
1answer
468 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
2
votes
1answer
298 views

Simple way to extend AES to 256-bit block size

What is the best way to use standard AES with a 128-bit block size to act as a 256-bit block cipher? I am aware of CMC and EME which seem to serve this purpose, but they seem to be more complicated ...
2
votes
1answer
3k views

CryptoJS.AES result always has same first few bytes?

When using this very minimal CryptoJS AES example: ...
2
votes
1answer
189 views

How to design a cryptographically secure file hosting service

How one would go about design something like Google Drive/Dropbox providing the following features: files are encrypted and decrypted on the client files can be synced between devices the service ...
2
votes
1answer
681 views

Since it gives negative power, how is rcon(0) calculated in AES?

I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation ...
2
votes
1answer
481 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
2
votes
1answer
813 views

Proper uses for CTR and CBC AES block cipher modes

Assuming the following: Key is randomly generated is being used (32 bytes+) IV is also randomly generated Crypto random key generator is used Data being encrypted contains common bytes like ...
2
votes
1answer
311 views

Is this method for exchanging private key using RSA sound?

Bob know's Alice's public key, and he wants to make sure he's connecting to the one which has that key. Furthermore, Alice wants to verify when she gets a connection from Bob who'll give his public ...
2
votes
1answer
739 views

Decryption a chunk of file with AES

We are having a requirement to store large files (~1GB) encrypted and decrypt them when reading. We are looking to use AES-CTR or AES-GCM mode to encrypt the data. There are scenarios where we want to ...
2
votes
1answer
283 views

Signing 14 bytes of data

for an embedded device I need to sign a 14-byte string and want to verify that string on the device. Since there is already an AES-Library on the device, I thought about using the following scheme: ...
2
votes
1answer
4k views

In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step? Is it the 10th round key? For example, is this the right order? ...
2
votes
1answer
2k views

AES-NI implementation examples

Newer Intel and AMD processors have hardware support for implementing AES using the instruction set AES-NI (instructions AESENC, AESKEYGENASSIST etc). Do you know of any clean example implementation ...
2
votes
1answer
99 views

How much weaker is AES-64 than AES-128?

It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ...
2
votes
1answer
56 views

Is the length limit of AES-GCM per key or per (key, nonce) pair?

AES-GCM has a limit on the length of the plaintext it encrypts: $2^{39} - 256$ bits. But is this limit per key or per (key, nonce)? That is, if I encrypt a message with the maximum length, and encrypt ...
2
votes
1answer
297 views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
2
votes
1answer
86 views

IV larger than block size of cipher?

Is there any advantage to using an IV larger than a cipher's block size? Say I'm using AES-256 in Galois Counter Mode (GCM). My file format looks like this: ...
2
votes
1answer
164 views

For a given PlainText-CipherText pair how many valid keys are there in AES?

For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under ...
2
votes
1answer
231 views

Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
2
votes
1answer
173 views

How AES treat string input to encrypt data and what will happen if the cipher key is less than that expected?

The official docs of AES have several example of how hexadecimal or byte input can be encrypted. I have some problem about the input text and cipher key. My question is: How can encrypt string input ...
2
votes
1answer
70 views

Using AES for smaller blocks in a Feistel network

I was wondering how decryption would work for FPE in the case of cycled Feistel ciphers. I understand that simply reiterating through the networks with reversed key order will generate the ciphertext ...
2
votes
1answer
222 views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors should not be used twice when using AES/GCM. I am using a counter as initialization vector. Every time I send out a new packet (I am developing an UDP based ...
2
votes
1answer
102 views

How to generate the APA SBox?

I am trying to generate the S-Box provided in the Affine Power Affine paper (PDF) but I'm not sure I understand it fully. The essence of the paper is this: ...
2
votes
2answers
955 views

nonce of AES-GCM in SSL

It seems that the nonce of AES-GCM in SSL has 3 parts: salt, 4 bytes, generated in handshake, not changed in whole session nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL ...
2
votes
1answer
209 views

How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
2
votes
1answer
353 views

Deduplication: Encrypting the SHA-256 hash of a file chunk

I'm designing a data storage system that should be both able to deduplicate data that share the same encryption key, and be reasonably secure. I know that this kind of encryption quality can be ...
2
votes
1answer
87 views

Post processing of AAD and len A||C in a hardware AES GCM implementation

I'm new to GCM and I need to implement it in hardware, using FPGA. The data bus is 640 bits, so I will use 5 adder/multiplier blocks in parallel. The message size and AAD size are constant. My design ...
2
votes
1answer
3k views

Probability that two different files can have same MD5 hash for both an unencrypted and encrypted version (AES256, same key between files)

This math is way over my head, and don't even know if it can be done, but here are the assumptions: Take unencrypted File [Fu] of variable length, but assume 100KB as an example. Let File [Fe] be ...
2
votes
1answer
180 views

Getting 88bytes cipher output from 48bytes input in AES

The other day I saw this Hybrid Cryptographic Algorithm in the Google and felt curious about it. I am trying to understand this Hybrid Algorithm. And hopefully its not so hard to understand whats ...
2
votes
1answer
868 views

Some questions about encrypting (AES) a file with password

I'm relatively new to encrypting, and I have some questions. I intend to write a standalone C# program that will write and read an encrypted file with sensitive data using a password entered by the ...
2
votes
1answer
528 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
2
votes
3answers
323 views

Is it overkill to run a key generated by OpenSSL through pbkdf2?

I'm generating a key & iv with OpenSSL via: ...
2
votes
2answers
1k views

Achieving 256-bit encryption strength with PBKDF2 - HMAC-SHA1

I am interested in the theoretical consideration of the bit strength of an encryption key and its precursor. Assume a given environment as follows: a. My encryption algorithm is AES-256 b. My key ...
2
votes
1answer
621 views

Review of AES encryption concept for an open source project

i'm working on an opensource project, A generator for static (html/js), password protected photo galleries. The generator AES 256 encrypts many images with the same key in PyCrypto, and decrypt them ...
2
votes
1answer
946 views

How to break AES CBC with PKCS#5 padding?

If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?
2
votes
0answers
58 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
2
votes
1answer
61 views

Why is AES-128 considered secure while RSA needs a 1024-bit size to be considered secure [duplicate]

I got asked this question today and I didn't know the answer, AES-128 is considered secure, the key size is 2^128, so you would need in average 2^127 tries to break the key. Why does RSA need at least ...
2
votes
0answers
32 views

Are collisions in AES-128 theoretically possible when the plaintext is the same? [duplicate]

Is it theoretically possible to find $P$, $K$, and $K^\prime$ such that $E_K(P) = E_{K^\prime}(P)$ where $E$ is AES-128 and $K \ne K^\prime$? I'd imagine this would be infeasible, but is it actually ...
2
votes
0answers
53 views

Reference AES-NI assembler code for AES-128-GCM? [closed]

I want to implement AES-128-GCM in assembler using Intel AES-NI instructions. I have found reference code in the Intel AES-NI Whitepaper but I don't see code for the GCM mode there (or indeed any use ...
2
votes
1answer
166 views

Best practises to generate IV for AES-CTR in this scenario

I'm building a cloud storage application that will store files on my servers. I want these files to be encrypted with AES in CTR mode and the key will be always the same. I'm wondering what would be ...
2
votes
0answers
178 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
2
votes
2answers
255 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
2
votes
0answers
73 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
84 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under ...
2
votes
2answers
83 views

AES multiple devices to server communication

I have multiple devices connecting to a server, whose communication needs to be encrypted. At the moment I have an AES library doing the job (possibly inadequately): I am using a database of keys on ...
2
votes
0answers
82 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
2
votes
0answers
108 views

Timing attacks against RSA, DH and AES

I have been reading about “Timing Attacks on RSA: Revealing Your Secrets through the Fourth Dimension” by Wing H. Wong. I was wondering if this attack is feasible while signing with RSA and, if yes, ...
2
votes
0answers
214 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
2
votes
0answers
819 views

How do I enable AES-NI (hardware acceleration) for Node.js crypto on Linux? [closed]

I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions. These functions use OpenSSL, so they should support AES-NI, but when I correctly enable ...
2
votes
0answers
155 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
1
vote
2answers
881 views

Is storing original file size in an encrypted file header a bad idea?

I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...