(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

3
votes
1answer
121 views

Attacks on AES-128 (ECB) based on some knowledge of plaintext

I'm working with a third party protocol which employs AES-128 in ECB mode of operation to encrypt a packet composed of 16-byte blocks (it encrypts each block independently). I'm trying to determine if ...
3
votes
1answer
159 views

How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as: $$ \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ...
5
votes
1answer
98 views

Condensed ElGamal + AES

In normal ElGamal encryption, the encrypted message is a pair (gb, gabM) - that is, the actual "encryption" is simply multiplication by the shared secret ...
2
votes
3answers
114 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
1
vote
1answer
66 views

How can I find the multiplicative inverse in the first transformation of the SubBytes() transformation in AES?

In FIPS-197 §5.1.1 , it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field $\text{GF}(2^8)$ described in Sec. 4.2; the ...
4
votes
1answer
116 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
1
vote
0answers
56 views

Modes of Operations Exercise

I am currently stuck at an exercise for my Cryptography Class in University which is: Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). ...
0
votes
2answers
65 views

Key cracking: Prefer many small texts over one large text?

If an attackers sets out to crack the symmetric key of e.g. AES-CTR, would they prefer to have access to many small cryptotexts or one large cryptotext? I.e. is it more interesting for the attacker to ...
3
votes
1answer
155 views

Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
1
vote
1answer
96 views

Value of “counter” when decrypting AES in CTR mode?

If – when using AES in CTR mode – you decide to use the setup where you combine the IV and the block count value into a single value, as suggested here, the first 12 bytes are your IV and the last 4 ...
2
votes
1answer
99 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
3
votes
1answer
120 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
1
vote
1answer
276 views

Can AES decrypt with a wrong key?

The title is asking the question in layman terms, but what I really mean to ask is this: Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ ...
0
votes
0answers
61 views

AES/CBC fixed Initial vector use-case [duplicate]

I am using AES/CBC to encrypt my http cookie. I never encrypt the same cookie value twice so my understanding is I don't need to use a random initial vector - using a fixed initial vector is fine for ...
2
votes
2answers
99 views

How can one parallelize tasks in CTR-AES for maximum performance?

From what I have read it seems like one of the purported benefits of using CTR mode AES, is that it can be parallelized to a greater degree, or maybe more easily than the other block cipher modes, ...
1
vote
2answers
470 views

Combining multiple symmetric encryption algorithms - implications?

I was just wondering if I add more security by combining two or more symmetric encryptions on a plain text. For example: Plaintext → AES → Twofish → Serpent Of ...
11
votes
3answers
39k views

How secure is AES-256?

The cipher AES-256 is used among other places in TSL/SSL across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
2
votes
1answer
133 views

Some questions about encrypting (AES) a file with password

I'm relatively new to encrypting, and I have some questions. I intend to write a standalone C# program that will write and read an encrypted file with sensitive data using a password entered by the ...
1
vote
0answers
39 views

For enciphering messages with AES in CTR mode, do I need a different key for each message?

I have written a program to run AES in CTR mode with keys of 128,192 or 256 bits and checked it gives correct results with the data given in section F.5 at ...
-1
votes
1answer
44 views

Error propogation in CBC mode

Going through the wiki for modes of operation I see that the section error propogation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
0
votes
1answer
156 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
2
votes
1answer
91 views

Efficiency of chaining AES “groups” of blocks

From ISO/IEC 23001-7:2012/Amd 1:2012 10.2.2 Creation of Initialization Vector (Informative) Decryption efficiency may be improved if subsequent initialization vectors use the value of the last ...
2
votes
1answer
119 views

Simple way to extend AES to 256-bit block size

What is the best way to use standard AES with a 128-bit block size to act as a 256-bit block cipher? I am aware of CMC and EME which seem to serve this purpose, but they seem to be more complicated ...
2
votes
1answer
132 views

Is AES-256 over AES-128 weakening the original encryption?

When transfering data using TLS the browser and server agree the cipher suite to be used - so for example this could be chosen as AES-128 and is (probably) outside of my control. If I separately ...
3
votes
1answer
238 views

Any use for now-defunct Mt Gox Yubikey?

As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the ...
2
votes
3answers
239 views

Problems with using AES Key as IV in CBC-Mode

I'm a pentester and currently analysing a web application which are using some strange encryption scheme. The point is: They encrypt using AES-128, generate a (not cryptographic secure) key and use ...
2
votes
2answers
469 views

Does the secret key used in AES have to prime?

I’ve looked around this site and the web quite a bit, but can’t find a definitive answer on whether or not the secret key $k$ used in the AES crypto-system has to be a prime number? Or can you just ...
1
vote
1answer
110 views

Does AES 256 really make sense in hybrid crypto systems when the PKI is the bottleneck?

AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to keylength.com a 2048 bit public key corresponds to 112 bits of security. Does it make sense to use AES 256 in this ...
1
vote
1answer
147 views

About the Rijndael/AES sbox polynomial (subBytes)

I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have: Why $\,m(x)$ was chosen as ...
2
votes
3answers
168 views

How do I produce a stream of secure random numbers from AES-Counter mode?

I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly. I have read that AES-CTR can produce a stream of ...
1
vote
1answer
79 views

AES and One Time Passwords

I have used AES to secure my short term wireless network(1 day lifetime). The same symmetric key is used for securing entire network traffic. is it possible to improve security with onetime password ...
3
votes
1answer
87 views

Performance for Subbytes in AES

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set. For the Subbyte function i use movzx, having loaded ...
3
votes
1answer
183 views

ECC public key encryption and authentication - ECIES with ECDSA vs ECDH with AES

I'm currently working on a project where I want to establish a secure and authenticated communication channel between to entities, using Elliptic Curve Cryptography. Now I'm not really sure how to ...
7
votes
1answer
423 views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
6
votes
1answer
139 views

Why is the polynomial in AES MixColumns multiplied modulo a reducible polynomial?

I know that the AES MixColumn step is calculated as follows $b(x) = (a(x)c(x)) \mod l(x)$ with $a(x)$ being the column to encode, $c(x)$ the fixed polynomial $c(x) = 3x^3 + x^2 + x + 2$ and $l(x) = ...
4
votes
1answer
923 views

Is AES still secure considering all this NSA/Snowden scandal? [duplicate]

Im trying to understand if nowadays using AES is secure or not, after reading some arguments on Schneier’s blog (to be more exact, a comment to “The NSA Is Breaking Most Encryption on the Internet”) ...
0
votes
1answer
316 views

Diffie-Hellman Secret Exponent Size and Shared Secret Usage [closed]

I'm developing my own protocol and I'll use Diffie-Hellman to achieve PFS. It will work in this way: The symmetric encryption algorithm will be AES_256_CBC. The DH parameters will be: P: a 2048-bit ...
2
votes
2answers
101 views

Is HMAC necessary if the AES ciphertext of a message includes the CRC of the message?

I've seen that encrypting an image with AES-CBC then calculating the HMAC-MD5 value for authentication is a somewhat common and sound way to secure data. Alternatively, can I just calculate the CRC of ...
1
vote
0answers
18 views

Cryptography — with a semi-priveleged user in the middle — to prevent request-tampering with another server

I'm working on a chat server for a mobile app I am writing. I would like to use a different application server for non-chat related operations and another application for chat operations. I would ...
2
votes
1answer
93 views

“Fine grain Cross-VM Attacks on Xen and VMware are possible” and OpenSSL 0.9.7

Here's a paper that just made its way into Cryptology ePrint Archive: Fine grain Cross-VM Attacks on Xen and VMware are possible!. Its a good survey of past attacks and presents a couple of new ...
3
votes
2answers
212 views

Leaving authentication data blank less secure for AES GCM?

The AES GCM example for Ruby / OpenSSL shown at: http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html has a GCM example of the following: ...
1
vote
1answer
184 views

Usage of different size chunks during AES encryption/decryption

I want to encrypt user's files on our server. For this purpose I decided to use the PHP Mcrypt library. I chose to use the Rijandel-128 algorithm and CBC mode for encryption. Since files are quite ...
14
votes
2answers
774 views

Are AES-256's related-key weaknesses exploitable if it is used to build a hash?

Assume it is made a hash based on AES-256 encryption (perhaps because this is hardware-accelerated, but no standard hash is); and it is used the Merkle–Damgård structure, that is padding of the ...
2
votes
2answers
181 views

Does AES-128 have the same strength as AES-256 with a padded key?

When I use the same 128-bit key for AES-128 and AES-256 with a known/public padding for the latter, is there some weakness in AES-256 that is not present in AES-128 with essentially the same key? ...
1
vote
1answer
68 views

What is a 'secret key factory'? What precisely is it doing? [closed]

I have found a Java implementation of AES CBC mode that runs in Netbeans. The lines below appear to create the key from password and salt: ...
1
vote
0answers
74 views

How we transfer 128bits cipher to a 4x4 matrix for AES input?

Why the input cipher for AES encryption, can write in 4x4 matrix with 8 bits entires, and can said is 128bits? if each cell is 8bits in binary, how we said this matrix is represent 128bits?
1
vote
1answer
97 views

AES-256 Shift-Rows Offsets

I am currently trying to implement a AES-256 cipher according to this sepcificaciton: http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf As well as on Wikipedia and in the document ...
5
votes
1answer
230 views

Secure AES Key Generation via Salsa20?

I am not creating my own cryptography or anything, but to learn about the Dos and Donts of cryptography, I am looking into AES encryption and ways to generate keys for that. As far as I've ...
1
vote
0answers
38 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
1
vote
1answer
60 views

Prefixing data before encryption for passphrase confirmation?

I'm encrypting data with AES, using CryptoJS. CryptoJS returns an empty string in case the data couldn't be encrypted with the given passphrase. I'm not sure if this is intended, or happens in all ...