AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

2
votes
2answers
1k views

AES + CBC encryption for a stream of UDP packets

I am developing an application that is based on UDP, and I need to send a stream of packets. As you can imagine, packets can get lost or corrupted. I need to make sure that the content of those ...
2
votes
1answer
791 views

How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
2
votes
2answers
218 views

Can I simulate iterated AES-ECB with other block cipher modes?

I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding ...
2
votes
1answer
376 views

Is it safe to AES-CBC and AES-CMAC both using the same key?

There is a very similar question (Using a derived key for CMAC) but it doesn't quite answer this one (at least for me it does not). I have a situation where I need to transfer some data. My data has ...
2
votes
1answer
245 views

AES-CTR-256 Sub Keys With Encrypted Sub Key Index

I was working with some encryption and I decided to put a spin. To preface this would be used to encrypt multiple files. You start with a key file generated from random data. For example you could ...
2
votes
1answer
488 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
2
votes
3answers
551 views

How do I produce a stream of secure random numbers from AES-Counter mode?

I have just made my own program to encipher, using AES in counter mode, and have validated it using NIST data. So I know I have done it properly. I have read that AES-CTR can produce a stream of ...
2
votes
2answers
684 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
1
vote
1answer
237 views

Symmetric mutual authentication with client using a derived secret

I'm attempting to find a client/server authentication protocol that allows the client and server to authenticate each other when the client doesn't know the server secret but does have a sensitive key ...
0
votes
1answer
602 views

Understanding multiplication in the AES specification

I am reading through the AES specification and am not able to wrap my head around the multiplication definition (section 4.2). Sorry to refer to a spec but AES is the holy grail in crypto so I hope ...
11
votes
2answers
1k views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
10
votes
1answer
1k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
5
votes
3answers
694 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
5
votes
1answer
500 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
5
votes
1answer
748 views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
4
votes
2answers
108 views

Encrypt-then-HMAC implementation - am I doing it right?

I want to implement authenticated encryption using C#. There is a dot net class called encryptAndAuthenticate, but it is only supported on windows 8 or later, and I need the code to also work on ...
4
votes
2answers
157 views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
4
votes
1answer
151 views

CBC-MAC just to verify integrity

I have a message and I want to verify its integrity and authenticity. I have a shared secret (key) that is not used for other encryption. Is it safe to send a plaintext message containing all the ...
4
votes
2answers
327 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
4
votes
2answers
2k views

Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?

The system requires to be as paranoid as possible regarding security. One of the few contemplated changes to the current design is to use multiple encryption. First proposal was to use Serpent on top ...
4
votes
1answer
725 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
3
votes
2answers
688 views

Is AES solvable by reducing to SAT?

Consider a known plaintext attack on AES — just so we have an actual system of equalities that we can feed to a SAT solver. Is AES solvable in this way? In other words, will the algorithm eventually ...
3
votes
1answer
3k views

Why is Serpent faster than AES in this benchmark?

I have a laptop without the AES-NI CPU instructions but with SSE4.1. I'm using Linux and tried the (in-memory) cryptsetup benchmark to get the rough tendency which returned: ...
3
votes
1answer
566 views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
3
votes
2answers
649 views

How can I add more rounds to AES?

I'd like to understand a bit more about the AES key schedule if anyone would mind explaining that. For instance, why is the way the schedule generated (with recursive xors and occasional ...
3
votes
1answer
763 views

Advanced Encryption Standard Algorithm Secret Key

just a follow up question with this question.. How does the key schedule of Rijndael looks for keysizes other than 128 bit? A 256-bit key can still encrypt a block of plaintext in 128 bit? but in ...
2
votes
3answers
145 views

Memory hard key derivation (password hash) using AES encryption

I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt). My ...
2
votes
1answer
310 views

About the Security of PCBC Encryption Mode

We are designing an encrypted file system. We plan to use the PCBC (Plaintext Cipher Block Chaining) encryption mode for encryption. This is because we desire the feature ("small changes in the ...
2
votes
1answer
201 views

How does ccrypt work?

On many Linux/GNU distributions CCrypt (ccrypt) by Peter Selinger is available as a command line utility to encrypt files. How does the protocol work and is it ...
2
votes
2answers
499 views

Polynomial representation of the affine part of the AES S-box

I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES” by Murphy and Robshaw) and I can't get it to produce the correct output. ...
2
votes
1answer
148 views

AES Message Authentication Vulnerability

My securities instructor recently posed this question to the class and I am bending my brain in half trying to figure it out. Suppose $y_1 = AES(K, x_1)$ and $y_2 = AES(K,x_2)$, and suppose you ...
2
votes
1answer
2k views

What is the probability of breaking the AES algorithm?

I am doing a project which requires the encryption to be done using AES. Is it really possible (technically) to crack AES? If yes, please tell me: What is the probability of breaking AES? How ...
2
votes
1answer
1k views
2
votes
1answer
425 views

Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
2
votes
2answers
1k views

Capacity of Advanced Encryption Standard in terms of File Encryption

what is the capacity of AES in terms of File Encryption? is it really good to encrypt a large files in AES? ex. I am encrypting a 8GB of File... is it still good to used AES? is it still good to used ...
1
vote
1answer
250 views

Difference between AES CMAC and AES HMAC?

Can someone elaborate on how 'signing' is done using AES- CMAC and AES-HMAC? HMAC Signing as I understand: Compute the HMAC( Hash the key and the input concatenated in a special way) Verification: ...
1
vote
2answers
136 views

AES key equal to IV (CBC mode)

Application uses AES in CBC mode with 128 bit key. In this implementation key is always same and is equal to IV. Can attacker get the key or decrypt data? If he knows: First and second blocks of ...
1
vote
0answers
114 views

Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
1
vote
1answer
122 views

Algorithm to transform plaintext to a key of desired keysize, when using input plaintext as key for FPE?

Using a format preserving encryption scheme that uses AES internally as its block cipher, for a plaintext that I encrypt I want to use that input plaintext as the key. However using AES-128, my ...
1
vote
1answer
72 views

Execution speed of AES_128 GMAC operation

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other ...
1
vote
1answer
238 views

How often do I need to rotate AES 256 keys

I'm trying to design a protocol for a resource constrained environment. The device has to communicate with a server through an insecure node. My plan is to use AES 256 end to end for all ...
1
vote
0answers
50 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
1
vote
1answer
1k views

Is the salt value a secret or can it be stored in cleartext just like the IV? [duplicate]

From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. ...
1
vote
1answer
126 views

Two files encrypted with related data versus one file

I have some code that takes a list of credit-card numbers, splits the number into two chunks, one chunk is 8 characters long, the other chunk is the remainder. Each series of chunks is saved into ...
1
vote
1answer
2k views

Blowfish: hex digits of pi used for s-boxes?

Preface: here is the official site for the Blowfish algorithm: http://www.schneier.com/blowfish.html The Blowfish algorithm uses an s-box, which consists of hex digits of pi (found here: ...
0
votes
1answer
159 views

Probability of guessing random 128-bit AES key [closed]

Consider the following five events: Correctly guessing a random 128-bit AES key on the first try Winning a lottery with 1 million contestants Winning a lottery with 1 million contestants 5 times in ...
0
votes
1answer
315 views

Where can I learn the basics of AES?

I was tasked with making an expo about AES and its steps, but I still can't grasp it, especially when it comes to "key schedule". Does anyone know some good material to start learning? Or can someone ...
0
votes
0answers
21 views

RFC 5297 implementation [duplicate]

I am looking for an implementation of RFC 5297 algorithm using javascript. I would like to see how to wrap a key on client side web browser, like Mozilla's fxa-auth-client (That uses a xor to wrap) ...
0
votes
1answer
414 views

Encryption and HMAC in a PSKC file

This is the PSKC standard https://tools.ietf.org/rfc/rfc6030.txt In Section 6.1 6.1. Encryption Based on Pre-Shared Keys They have the following ...
0
votes
1answer
133 views

Is AES's parity key-dependent?

Is the parity of the permutation of the set $\{0,1\}^{128}$, defined by AES encryption for a certain fixed key, dependent on this key? DES, and any pure Feistel cipher, has even parity for any key. ...