AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

0
votes
2answers
56 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
1
vote
1answer
42 views

How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
2
votes
0answers
58 views

AES encryption time difference for same data [duplicate]

When encrypting same data with AES, encryption time for the first encryption is longer than the second one. In the same program, I have written encrypt() function ...
3
votes
0answers
63 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
5
votes
1answer
219 views

How does Microsoft's BitLocker Recovery Code work?

I don't trust Microsoft BitLocker because it is closed source, which makes it so people can't audit it. But now I'm really interested in how its recovery code works. In my own knowledge, encrypted ...
18
votes
0answers
49 views

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? [duplicate]

Is there a key for AES-128, 256 etc, where cleartext equals ciphertext? (regardless of modes like chaining or ctr-cbc)
3
votes
1answer
52 views

Using AES-CTR to generate AES subkeys from a master key and nonce

Suppose I would like to encrypt some data using AES-GCM because it has hardware support on my processor and it is secure. Unfortunately, I don't like the 96-bit nonce size, because I want to randomly ...
0
votes
0answers
33 views

Can we use more than one irreducible polynomial in AES?

I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key ...
9
votes
2answers
2k views

Why is the permutation in AES (and other ciphers) not random or key-dependent?

If the permutation in AES (or other ciphers) were randomly generated or dependent on the key, would it not be stronger against differential attacks? If this is so, then might we need fewer rounds for ...
6
votes
2answers
352 views

Nonce encryption with Poly1305-Chacha20

I have seen that a couple of companies (like Google, Apple HomeKit) are adding "ChaCha20-Poly1305" as an encryption option. Poly1305 requires algorithm to encrypt the nonce. The Poly1305-AES ...
3
votes
1answer
75 views

Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
1
vote
1answer
52 views

Disk encryption using AES-CBC: is reliance on previous block data a downside?

I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
0
votes
2answers
79 views

Brute force knowing a part of the password

So here is the problem, my brother forgot about the eight digit numeric part of his password, he is using Ubuntu 15.04 default whole disk encryption To make it clear, this was his password (example) ...
5
votes
2answers
381 views

Does the SHA-256 sum of a 256-bit key help you crack it?

If I have the SHA-256 sum of a 256-bit AES key, can I determine the key any faster than if I merely had a ciphertext and the corresponding plaintext?
12
votes
2answers
821 views

Is it possible to utilize an AES-128 encryption hardware unit for AES-256?

There exist processors (for example ARM v8/v9 archicteture based), which cannot do AES-256 hardware based, but are equipped with AES-128 encryption hardware units. Is it possible to utilize an ...
4
votes
2answers
132 views

Encrypt-then-HMAC implementation - am I doing it right?

I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on ...
3
votes
0answers
103 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
1
vote
0answers
34 views

Is parallel, vectorized NORX nearly as fast as hardware-accelerated AES-GCM?

As I understand it, NORX gets 3.5 CPB in an unoptimized implementation. But NORX can be parallelized. With 4-way SIMD, I would expect about 7/8 CPB performance. This is nearly as good as AES-GCM in ...
1
vote
0answers
26 views

AES - Size of T-Boxes and obtaining T-Box values

In article "A high performance ST-Box based unified AES encryption/decryption architecture on FPGA" (http://www.sciencedirect.com/science/article/pii/S0141933115001945) two 32Kb dual-port BRAMs are ...
5
votes
2answers
79 views

How does the split mask countermeasure work on AES?

I am trying to understand the split mask countermeasure which is a masking method to avoid side channel attacks. Let's first describe the principle and then try to apply it to AES. I found this paper ...
0
votes
1answer
52 views

Is webkey a reasonably secure authentication system?

I just created Webkey in the last couple days. This should allow any website to do single-password auth with a much higher level of auth security and convenience for users (single password with ...
4
votes
2answers
127 views

For what does “Rcon” stand for in Rijndael/AES?

How do we expand the abbreviation β€œRcon” used in the Rijndael key schedule? I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is ...
1
vote
0answers
48 views

Why need mapping to slots to embed bytes in AES-homomorphic encryption?

The encoding of each AES bytes $𝛼_𝑖$ is using CRT(Chinese remainder theorem). It means that there is an aggregate plaintext $H$ such that: $H \mod F_0 =𝛼_0(MappingData[0])$ $H \mod F_1 ...
3
votes
0answers
37 views

Cloneability of AES-128

I would like to implement an anti-counterfeiting scheme for tools my company manufactures. This would ideally be done via RFID/NFC tags. However, the environment in which these tags operate would ...
0
votes
1answer
37 views

Can I open a file in plaintext (already decrypt) but the cipher doesn't change?

I want to create an app that encrypts a file and saves it to the Dropbox. Thus, I open and edit this file, I want the file is already decrypted, but the encrypted file that stored in Dropbox still in ...
0
votes
1answer
41 views

Proper authenticated encryption

I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct. The message send over the network is: ...
4
votes
1answer
334 views

What is considered a “weak key” in AES?

I need to construct an AES key from an array of bytes (in Java), but I first I have to check if the key created from these bytes would be weak. Java can check for weakness for DES, but not for AES. ...
0
votes
1answer
35 views

Sodium crypto_aead_aes256gcm_encrypt ciphertext length > plaintext length

Using the crypto_aead_aes256gcm functions from Sodium produces a ciphertext of "at most mlen (plaintext length) + crypto_aead_aes256gcm_ABYTES bytes (16 bytes) are put into c (ciphertext), and the ...
0
votes
1answer
108 views

Is regular CTR mode vulnerable to any attacks?

Regular plain CTR mode, is it vulnerable to any attack? I plan to write a program to encrypt a drive with ctr mode. Would this be wise? Would AES be better? When I look at this diagram, it looks ...
0
votes
0answers
31 views

Decrypting a file encrypted with AESCRYPT using key instead of password

i have encrypted a file using aescrypt and took memory image while the file was being encrypted and hence have the key that was used for encryption in the image but not the password, can i decrypt the ...
0
votes
0answers
51 views

I am trying to understand how AES works

I am trying to understand how AES encryption operates. I am trying to run through the steps on paper to understand. So far, I am creating a simple example. I have the plain text "MESSAGE TESTTEXT" ...
2
votes
2answers
257 views

How secure is a client-side javascript encrypter?

A friend of mine needed help with her website and asked how to send me her login information securely. I've never known how to do this, so I figured now was the time to learn. After some googling, I ...
3
votes
1answer
72 views

Is it acceptable to write the nonce to the encrypted file during AES-256 GCM? [duplicate]

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm ...
0
votes
1answer
50 views

PyCrypto and AES: can i use a longer key than the block size (16byte)?

I see that in many scripts are used keys of 16 characters for a block of 16 byte, but can I use key of 40 (for example)? And then why in some scripts with aes module the block size is set to 32 byte ...
6
votes
3answers
861 views

AES key reuse and guessing the key

Bit of a noob question and a fair bit of Googling didn't help. I understand that the current encryption standard is AES256. A few questions Is the point of this (and other encryption techniques) to ...
0
votes
1answer
73 views

Why does AES ciphertext entropy always close to 8?

I have three binary files: 31744 byte length (1), 5712980 byte length (2) and 10806008 byte length (3). The alphabet is all 256 symbols from 00 to ff. I compute the shannon entropy, replacing ...
1
vote
1answer
98 views

HMAC-SHA1 vs. AES

This might be a very silly question, but I am a total novice in encryption. I don't know where to start searching for an answer to this problem. I am building applications using a proprietary ...
0
votes
0answers
18 views

is it possible to reverse engineer the key on a AES-256 encryption? [duplicate]

If I have the original text and the encrypted one, is it possible to reverse engineer the key? And more importantly is it doable ? I tryed to look up the algorithm but i'm way too rusted and with no ...
0
votes
0answers
81 views

Difference between AES-CCM and AES-CCM*

I'm trying to understand the different between AES-CCM and AES-CCM* (as defined in IEEE Std 802.15.4ℒ‐2011, Annex B). I see that there are more restrictions on L and M and also M=0 is allowed: L = 2 ...
1
vote
0answers
42 views

Rijndael variant using AES for key schedule?

The weakest part of Rijndael is considered to be the key schedule (I believe that this is true for all variants, including ones not standardized as AES). One solution to this problem is to use ...
6
votes
1answer
162 views

Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?

As I'm using HMAC to ensure integrity and authenticity of the ciphertext, is there any additional security benefit to verifying PKCS#7 padding when decrypting using AES CBC? A previous question asked ...
4
votes
2answers
145 views

Help with breaking AES reduced to 2 rounds

I was studying Rijndael AES proposal, and its cryptanalysis. I started with writing code to break AES reduced to 2 rounds. I am using 128 bit key size and 128 bit block size. 2 round AES means the ...
0
votes
2answers
38 views

Trying to understand MixColumns with Hexadecimal matrix

I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook has a final answer and it does not clarify how it got the result. I am trying to ...
3
votes
2answers
696 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES β€” just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
0
votes
1answer
65 views

Key derivation using the main AES encryption key and some plain text

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
5
votes
1answer
117 views

Fixed-prefix IV in CBC mode

I know the Initialization Vector needs to be unpredictable. Does it apply to the IV as a whole, or to every bit in the IV? I have multiple devices with poor entropy sharing the same key and I want to ...
0
votes
1answer
42 views

What about using AES-ECB with random IV?

Let P1P2...Pn be n blocks plaintext, and M0 be a random IV. Then a n+1 blocks message M0M1...Mn can be constructed by setting Mi+1 = Mi xor Pi+1. Finally, we use AES-ECB to encrypt this message. Is it ...
0
votes
0answers
43 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
0
votes
1answer
58 views

Apple encrypted DMG volumes strength?

Apple OS X can create encrypted AES 128/256 DMG volumes. Here is written about a men who was able to hack it. And also that DMGs use PBKDF2-HMAC-SHA-1. I couldn't find more information about encrypted ...
0
votes
1answer
114 views

What is a branch number in the PAEQ algorithm?

I'm reading an article about authenticated encryption algorithm - PAEQ. It uses a permutation function AESQ, which has transormations from AES. And there is written about MegaSBoxes, which contain 4 ...