AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

6
votes
1answer
214 views

How to assess the strength of the avalanche effect for AES?

Within the scope of a study project I'm looking for an approach to assess the quality of AES encryption in practice. To do so, I modified the OpenSSL source code to be able to log metrics while ...
5
votes
1answer
99 views

Generating an IV for AES-CBC

I am faced with the task of generating a secure 256-bit IV for AES-CBC. I possess the following resources: A 32-bit microprocessor A 32-bit PRNG (can read/reseed) A 64-bit clock counter (can read) ...
0
votes
0answers
27 views

Is there a reduction of security if I XOR Pkcs5S2 and SecureRandom?

I'm using this codereview sample to encrypt data. I would like to provide hardware protected encryption and a user password as the key. Is it acceptable to XOR the KDF Pkcs5S2 in Bouncy Castle with a ...
0
votes
1answer
88 views

Key exchange problem

I've found the following problem in one of my courses. Any tips on how to solve this would be appreciated! Alice has the key pair $(pka,ska)$. Bob has the pair keys $(pkb,skb)$. They want to ...
0
votes
0answers
13 views

Fixed initialization vector in aes cbc [duplicate]

What are the pros and cons of using fixed iv in aes-cbc encryption? I've read somewhere that it said using fixed iv doesn't really matter?
1
vote
1answer
46 views

How to increment the counter value for CTR mode?

I am testing CTR mode on STM32 board. I want to know how the auto increment of counter happens and what is the method to follow if I have to increment the counter manually.
0
votes
1answer
49 views

Security of AES CTR with multiple messages containing the same known plain text

I have this scenario: The same plain text (that is part of an unkown bigger message) is being ecrypted multiple times using AES 128 CTR with a random key, the key is being transfered encrypted using ...
5
votes
1answer
82 views

How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

The only way I see it possible to do the matrix-multiplication in the MixColumns operation of AES is by shifting the bits in the multiplied number, and then reduce with the polynomial if needed. ...
4
votes
2answers
91 views

Twofish MDS and PHT

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = Minimum~of~[...
2
votes
1answer
124 views

How much weaker is AES-64 than AES-128?

It's hard to say exact QC specs, but let's assume we have decent a quantum computer using Grover's algorithm that is able to half AES-128 keyspace to that of AES-64. How long will a bruteforce attack ...
1
vote
0answers
53 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
4
votes
1answer
53 views

How can bit slicing be constant time, when Mix Columns is in the cipher

I'm reading about bit-slicing techniques, and one thing about it caught my mind. The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ...
0
votes
0answers
47 views

Attacking AES-CTR mode with known prefix [duplicate]

My question is the following: Consider a 128-bit AES-CTR mode encryption on a plain-text $m$ . The structure of $m$ is constant. First comes a string, let's say : "JustSomeText\" followed by 5 ...
0
votes
1answer
541 views

Are there attacks on AES with 16-bit keys? [closed]

Are there known attacks on AES that uses a 16-bit key? Assuming the data can be 95MB size, and that I can request the same data over and over. For example, can someone explain to me how this code ...
5
votes
1answer
46 views

In Fortuna, can I use ChaCha20 instead of a block cipher and Blake2b instead of iterated SHA256?

In the Fortuna CSPRNG, can I use ChaCha20 instead of a block cipher and Blake2b instead of double SHA256, and still retain security? My hypothesis is "yes" because: The block cipher's only use is ...
0
votes
0answers
24 views

Securely register a client in server using AES an RSA

I've designed the following protocol to send the client's public key to the server. Initially, the client knows server's public key, but the server does not know the client's public key. client ...
1
vote
0answers
58 views

Is it safe to encrypt data using XOR along with CSPRNG seeded with a truly random number? [closed]

I was wondering a couple of days ago whether I could reverse the normal encryption order to produce a good AES based cipher variant. The method is as follows: Two users, Alice and Bob, each have a ...
1
vote
1answer
123 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
0
votes
0answers
100 views

Deoxys: disadvantages vs. AES?

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
0
votes
1answer
101 views

Symmetric cipher speed (AES vs Camellia vs Twofish)

If I have understand correct, Twofish is more secure (harder to break) than AES and Camellia, but Twofish is slower than AES and Camellia. But how can I mesure the speed difference between AES vs ...
2
votes
1answer
79 views

What would happen to AES if we replaced MixColumns with ShiftColumns?

I have this as a question in an assignment and I guess I don't fully understand the steps. I understand that if we omit MixColumns, then every byte of the ...
1
vote
1answer
77 views

How is decryption done in AES CTR mode?

Since AES CTR mode uses a unique IV and counter to produce the key to XOR with the plain text to get the ciphertext, the question is so as to how decryption is done. Since AES CTR produces a ...
1
vote
1answer
96 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
1
vote
1answer
68 views

How secure is the OTR protocol?

I am using Adium and wondering how secure it is. I believe it uses AES-256 (I do not understand what that means) by default. It also requests that users exchange fingerprints with each other before ...
0
votes
2answers
281 views

Length of encryption password aes-256-cbc

I'm encrypting a file with sensitive information with cat secret | openssl aes-256-cbc -a -salt > secret.enc I am choosing a random encryption password with <...
1
vote
0answers
71 views

How to use OpenSSL command line utility to encrypt data with encrypted key from public key?

I may not be asking the right question. I am fairly new to data encryption. I am currently being sent encrypted data that's stored as follows: [ [keysize] [key encrypted with public key] [ivsize] [...
3
votes
1answer
58 views

Do you need a HMAC if decryption attempts are severely limited?

I am considering an application where data bandwidth is extremely limited, and considering removing message authentication codes from encrypted transmissions. The encryption method is currently AES-...
1
vote
1answer
77 views

SHA256(RsaPrivateKey) == AES key?

I have an RSA private key (more specifically, an SSH key in Putty format, 4096bit) and want to use its SHA256 hash as an AES256 key, instead of using an independent newly generated AES key. Are ...
1
vote
2answers
81 views

Parallel file encryption and authentication for large files

For a cloud storage upload client I want to encrypt files during upload, so that they cannot be read by the cloud service provider or anyone who gains access to the account. I would like to use some ...
2
votes
3answers
369 views

What is the fastest block cipher in the (Intel) world?

In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than ...
3
votes
2answers
97 views

GCM: use the same key:IV pair to encrypt file and filename

Using Java, I wrote a piece of code that encrypts a given file with AES in GCM mode of operation. So far nothing uncommon. Now I would also like to encrypt the filename, in the following way: ...
3
votes
1answer
105 views

Deriving AES key and HMAC key from shorter master key

I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1. SHA1's output size is only 160 bits. But I am implementing authenticated encryption and thus ...
1
vote
1answer
67 views

Deriving 256-bit key from PBKDF2-SHA1

I am working in .NET and their PBKDF2 only uses SHA-1. I am using it to, given a user-supplied password and random salt, generate a 256-bit AES key. The plaintext is encrypted with the AES key and ...
-3
votes
1answer
119 views

How to Perform Computation on AES Encrypted Data

I have this code that successfully performs symmetric encryption using AES algorithm. How can I go about performing computation on it to achieve somewhat homomorphic encryption? ...
3
votes
2answers
551 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
0
votes
2answers
59 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
1
vote
1answer
79 views

How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
2
votes
0answers
58 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
3
votes
0answers
66 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
5
votes
1answer
287 views

How does Microsoft's BitLocker Recovery Code work?

I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted ...
18
votes
0answers
51 views

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? [duplicate]

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? (regardless of modes like chaining or ctr-cbc)
3
votes
1answer
62 views

Using AES-CTR to generate AES subkeys from a master key and nonce

Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure. Unfortunately, I don't like the 96-bit nonce size, because I want to randomly ...
0
votes
0answers
34 views

Can we use more than one irreducible polynomial in AES?

I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key ...
10
votes
3answers
2k views

Why is the permutation in AES (and other ciphers) not random or key-dependent?

If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for ...
6
votes
2answers
396 views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...
3
votes
1answer
87 views

Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
1
vote
1answer
55 views

Disk encryption using AES-CBC: is reliance on previous block data a downside?

I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
0
votes
2answers
96 views

Brute force knowing a part of the password

So here is the problem, my brother forgot about the eight digit numeric part of his password, he is using Ubuntu 15.04 default whole disk encryption To make it clear, this was his password (example) ...
5
votes
2answers
395 views

Does the SHA-256 sum of a 256-bit key help you crack it?

If I have the SHA-256 sum of a 256-bit AES key, can I determine the key any faster than if I merely had a ciphertext and the corresponding plaintext?
12
votes
2answers
836 views

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

There exist processors (for example ARM v8/v9 archicteture based), which cannot do AES-256 hardware based, but are equipped with AES-128 encryption hardware units. Is it possible to utilize an AES-...