(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

6
votes
3answers
2k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
6
votes
1answer
522 views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
6
votes
1answer
3k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
6
votes
1answer
652 views

What causes first block of AES decryption to be garbled, even with correct IV?

I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server. The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA ...
6
votes
2answers
988 views

GPG symmetric encryption and javascript

I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and ...
6
votes
4answers
2k views

Is there any opensource white-box implementation of AES or DES?

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided. The same page also links various papers about ...
6
votes
3answers
794 views

How can my application make sure the right symmetric key is used for decryption?

I am developing an Encryption/Decryption Utility using Adobe AIR. I have chosen the AES algorithm and currently use the as3crypto library for this. My query is in ...
6
votes
2answers
1k views

AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ? (The obvious answer would be ...
6
votes
1answer
2k views

How long does it take a quantum computer to brute force AES?

I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ...
6
votes
1answer
132 views

Why is the polynomial in AES MixColumns multiplied modulo a reducible polynomial?

I know that the AES MixColumn step is calculated as follows $b(x) = (a(x)c(x)) \mod l(x)$ with $a(x)$ being the column to encode, $c(x)$ the fixed polynomial $c(x) = 3x^3 + x^2 + x + 2$ and $l(x) = ...
6
votes
2answers
184 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
6
votes
1answer
1k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
6
votes
2answers
507 views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
6
votes
1answer
757 views

Is AES-XTS considered safe to encrypt multiple files with the same keys?

I was wondering if changing the cipher mode to AES-XTS in EncFS would be a sound idea. EncFS uses AES in CBC mode until the last 1KB block, and CFB mode for the last block if ...
5
votes
4answers
733 views

How to require two keyholders to decrypt a document?

I want to create a system to encrypt a document and store it with a 3rd party, but not have the 3rd party be able to decrypt it until some unspecified later date. It seems like the solution would be ...
5
votes
2answers
1k views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
5
votes
3answers
225 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
5
votes
2answers
559 views

Where can i get the info to implement AES?

I know there are 100's of AES programs and websites out there but I can't seem to find a site that give me the detail I think I would/should need to write my own java program. I was to write AES form ...
5
votes
2answers
2k views

Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

I've done research about this subject, but I can't find the answer I'm looking for. The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during ...
5
votes
1answer
610 views

Why does OpenSSL append extra bytes when encrypting with aes-128-ecb?

Plaintext: Attack at dawn!! Hex: 41747461636b206174206461776e2121 Key: ...
5
votes
1answer
5k views

AES CBC mode or AES CTR mode recommended?

what's benefits and disadvantages of CBC vs CTR ? which one is more secure ?
5
votes
1answer
235 views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
5
votes
3answers
4k views

AES 256 Encryption - Is it really easy to decrypt if you have the key?

So this might sound like a crazy question but bear with me for a minute. I can't find any info on the internet and so am here, although this might have been a good place to start. I've recently ...
5
votes
1answer
216 views

Secure AES Key Generation via Salsa20?

I am not creating my own cryptography or anything, but to learn about the Dos and Donts of cryptography, I am looking into AES encryption and ways to generate keys for that. As far as I've ...
5
votes
2answers
212 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
5
votes
1answer
263 views

Security for IV in AES-GCM mode

I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the ...
5
votes
2answers
2k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
5
votes
1answer
93 views

Condensed ElGamal + AES

In normal ElGamal encryption, the encrypted message is a pair (gb, gabM) - that is, the actual "encryption" is simply multiplication by the shared secret ...
5
votes
2answers
396 views

Camellia or AES - which should I use?

Imagine I am a software developer. I want a block cipher, and I have the choice of using AES or Camellia. Which should I use? Which makes more sense from a technical perspective, and why? I need ...
5
votes
1answer
262 views

Is it safe to encrypt a public key alongside a message with AES?

If I have a message M and a public key P, and I encrypt them alongside one another: CIPHER = AES(M + P, aes_key) Is CIPHER now weakened if someone knows what P ...
5
votes
1answer
213 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
5
votes
1answer
268 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
5
votes
2answers
753 views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
5
votes
1answer
822 views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
4
votes
2answers
296 views

Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
4
votes
2answers
292 views

Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
4
votes
2answers
390 views

Why is AES considered to be secure?

The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA. ...
4
votes
2answers
2k views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
4
votes
2answers
4k views

SHA-256 and AES-128

Does it make an encrypted string more secure if I use SHA256(x) instead of x as the secret key for AES-128 encryption? I do know that SHA-256 produces 64 characters of hashed string regardless of what ...
4
votes
3answers
936 views

Which of these 3 AES 128 symmetric encrypt/decrypt routines is most secure?

I am developing a symmetric en-/decryption routine written in c# for a database containing user-specific, sensitive information. I have narrowed down the implementation to 3 different approaches, ...
4
votes
2answers
2k views

Encrypted text length in AES

I have created an application that will be able to read any file and encrypt it using AES Encryption. For efficiency, I am reading a block of data, encrypting it and so on. So for decrypting, I just ...
4
votes
1answer
224 views

Can the AES encryption and decryption algorithms be described as a polynomial for a specific key?

AES is a block cipher that consists of non-linear and linear parts to provide the Shannon requirements of confusion and diffusion respectively. The linear parts can for sure be described as a ...
4
votes
2answers
431 views

How secure is the AES master key if Round Keys are found

If an attacker finds some round key of AES256, is it possible to find the master key? How safe is the master key if an attackers finds multiple round keys?
4
votes
2answers
2k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
4
votes
1answer
411 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
4
votes
1answer
873 views

Is AES still secure considering all this NSA/Snowden scandal? [duplicate]

Im trying to understand if nowadays using AES is secure or not, after reading some arguments on Schneier’s blog (to be more exact, a comment to “The NSA Is Breaking Most Encryption on the Internet”) ...
4
votes
2answers
346 views

Increasing number of rounds in AES

AES-128 requires 10 rounds ( AES Description, Wikipedia ) However Bruce Schneier has recommended AES-128 use 16 rounds ( Schneier on Security: New Attack on AES ) Could that be implemented as two ...
4
votes
1answer
168 views

What is 'security margin'?

I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, ...
4
votes
2answers
248 views

Is storing the hash of a key together with ciphertext encrypted with that key secure?

Is it secure to store the hash of a symmetric cipher key along with data encrypted with that key? Are there any circumstances or algorithms in which this combination could lead to potential weaknesses ...
4
votes
3answers
103 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...