Questions tagged [aes]
AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.
2,624
questions
0
votes
0
answers
31
views
AES S-Box design goal [duplicate]
First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
0
votes
1
answer
191
views
Linear approximation table of AES S-Box
I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
5
votes
3
answers
1k
views
Theoretical Approaches to crack large files encrypted with AES
I have a large file (> 200 Gb), that I encrypted a while ago with AES-256-CBC. The file itself is a tar which I ran through ...
1
vote
1
answer
71
views
Secure encryption in the presence of a keyservice
Imagine this scenario:
On a particular PC is a service that provides cryptographic functions -- in particular AES-CBC and ECC (ECIES/ECDSA).
The service provides access to a single key stored in an ...
1
vote
0
answers
78
views
How does changing one of AES encryption stages affect its security?
With regard to AES encryption on blocks, the next diagram showcase how does a change in one cell in the block (every cell is a byte) creates a change in encryption for ALL cells:
Now I have the next ...
1
vote
1
answer
121
views
AES CBC with random IV but key from PBKDF2 with same salt
TL;DR: Is encrypting data with AES CBC with random IV + PBKDF2 key using the username as salt safe?
I have searched the internet, but I could not find a proper answer that encompasses the "AES ...
4
votes
1
answer
210
views
How to determine cryptographic properties of AES S-Box?
In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
0
votes
1
answer
176
views
If ChaCha20 only has 128 bits, is it secure?
ChaCha20 also provides 256-bit encryption, i.e, 2^256 possibilities of keys. But ChaCha20 is very fast, I think it provides at most 2^256 multiplied by decrypting time. 256-bit AES provides 254-bit ...
1
vote
0
answers
52
views
What happens if the column mixing in AES is replaced by simple XOR and subtraction? [closed]
This is https://github.com/kokke/tiny-AES-c The column mixing function in the AES algorithm implemented.
...
1
vote
1
answer
172
views
Where in the TLS 1.3 record is the sequence number located?
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
0
votes
1
answer
52
views
Why is IV in RFC8448 examples only 12 octets instead of 16?
I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
1
vote
1
answer
660
views
Example of S-Box truth table in AES
I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say
A boolean function S : $ GF(2^n) $ ...
3
votes
1
answer
723
views
How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?
Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it.
My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
2
votes
1
answer
936
views
When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?
When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used),
should we use SHA-...
0
votes
0
answers
36
views
How do different encryption schemes scale as a relation between their security parameter and computational requirement?
For example is it harder to break one 256 bit encryption than two 255 bit encryption for RSA and AES?
For example, I understand that 256 bit RSA can be cracked in one minute according to this article [...
5
votes
2
answers
116
views
How to prevent power analysis on software level?
When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
0
votes
0
answers
84
views
Is it safe to store AES-KW encrypted key in database?
Use Case:
Web application accessed in browser. Registered users can store personal notes in the application, these notes are stored in a SQL database on a online server. The user can store unencrypted ...
0
votes
0
answers
66
views
Password Manager desktop app
I have built a small password manager desktop app using python. This app falls under the master-password model.The app connects to two databases stored locally. The first database stores the users ...
0
votes
0
answers
145
views
How to use NIST SP 800-22 to check randomness of 128 bits output in AES?
I am trying NIST SP 800-22 to test the randomness of 128 bit output in AES, but i always get igamc: UNDERFLOW or Segmentation fault (core dumped) error.
My data file has 128 bit output format, for ...
2
votes
0
answers
93
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
1
vote
1
answer
387
views
How long time per operation to crack Kyber1024 compared to AES256 for quantum computers?
How long time does quantum computers take per operation when search the key of Kyber? Grover's algorithm weakens 256-bit AES to 128-bit security, quantum computers at most take 2^128 operations to ...
2
votes
1
answer
78
views
How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?
I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows:
Design criteria for $S_{RD}$. We have applied the following design ...
2
votes
1
answer
137
views
AES encryption IV that won't need to be stored
I'm trying to implement an IV that won't need to be stored on it's own.
I'm considering 3 options:
Since I'm using PBKDF to generate a key I could use some bytes from the generated hash
I could use ...
1
vote
1
answer
41
views
Using Self-Generated Random Bits Instead of the Initialization Vector (IV)
I think my understanding on initialization vector (IV) might be lacking, but as I understand it, an IV is used to create randomness to an encrypted message so that the message is difficult to crack ...
0
votes
1
answer
112
views
Finding block mode and key length from encrypted data
I have an AES encrypted data and the key, but I am not able to tell the block cipher mode [ECB|CBC|CTR] used in encryption or know the key length.
Below is the encrypted data output in java.
...
2
votes
1
answer
59
views
What are the RCons for mini-AES if you want to encrypt more than 2 rounds?
I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper.
I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
0
votes
1
answer
69
views
Use name as the initialization vector to encrypt passwords for users
I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
0
votes
0
answers
36
views
Is it possible to generate a read-only key for a symmetrical encryption (AES)?
I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable, without the encoding key being exposed. This is the textbook use-case ...
1
vote
2
answers
1k
views
AES-GCM and tag length
Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding.
For instance, if ...
0
votes
1
answer
60
views
Clarification regarding AES-CTR
I was recently trying to perform a AES-128 CTR Encryption and Decryption.
I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
2
votes
1
answer
40
views
Threshold of resistance against Linear Cryptanalysis
In the AES proposal, the last sentence on page 30 it is said:
To be resistant against LC, it is a necessary condition that there are no linear trails with a correlation coefficient higher than 2^(n/2)...
4
votes
1
answer
77
views
Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?
I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference.
But I don't ...
1
vote
2
answers
98
views
Encrypting Small messages (BLE Beacon) - with little entropy - symmetric [closed]
I want to encrypt Bluetooth Beacon data. I was wondering if having very little entropy in the clear text would make the key easier to guess?
The maximum data length is 31 bytes
An example of the data (...
6
votes
3
answers
8k
views
Can Quantum Computers crack RSA and AES?
Im trying to learn more about cryptography and ran into a post, Is AES-128 quantum safe?, which asks if AES-128 is safe. From the articles and replies it seems that AES-128 (symmetric key) is safe ...
1
vote
0
answers
74
views
What mode in EVP for AES-128 should I use for cryptanalysis of AES?
I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*.
I need to use AES-128 ...
2
votes
1
answer
83
views
When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?
I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
2
votes
1
answer
87
views
In AES, why do we multiply the columns by a polynomial with a repeating coefficient?
In the MixColumns step of AES, one multiplies each of the columns of the $4\times 4$ box of bytes by the polynomial $a(x)=\{03\}x^3+\{01\}x^2+\{01\}x+\{02\}$ (modulo $x^4+1$). But in this polynomial, ...
2
votes
1
answer
334
views
Is it possible to reverse GHASH from GCM?
How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
2
votes
1
answer
256
views
Application firmware sign-then-encrypt vs encrypt-then-sign
I know that there are previous questions on the subject e.g. here, however I would like to ask it for my particular (simple) case.
I have an application firmware that is downloaded to a microprocessor ...
3
votes
1
answer
98
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
1
vote
0
answers
162
views
RSA Key Generation & encrypted output using OpenSSL
When is it generally acceptable, if ever, to generate RSA keys without encrypting the PEM output with another encryption algorithm?
I am working on a CI/CD process and want to leverage asymmetric ...
0
votes
0
answers
118
views
Problem in matching AES CTR encryption and decryption with two different engines
I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
0
votes
1
answer
147
views
Do multiple keys mitigate Grover algorithm?
Grover, a quantum algorithm, weakens AES and ChaCha20. Is it possible to use multiple symmetric keys to encrypt a message multiple times to achieve 256-bit security for quantum computers?
0
votes
1
answer
173
views
How does AES-CBC encryption achieve non-repeating blocks of ciphertext?
I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
0
votes
1
answer
122
views
Implementing AES GCM but not getting correct output from cipher block
I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect).
When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
0
votes
1
answer
123
views
AES GCM Difference between the IV and the Secret Key?
Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter.
The GCM specification examples state both an IV and a Secret Key as two inputs.
Can someone please explain ...
1
vote
1
answer
208
views
What is Inverse equivalent (decrypt) in the AES specification examples?
Referring to the AES specification:
https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf
Printed pages 35-37...
The first detailed walkthrough is encryption, the second is decryption.... I don't ...
2
votes
0
answers
105
views
AES key encryption on one time pad
I need to use the following scenario: There are 2 keys: AES-key and OTP-key (one-time pad). I encrypt the AES-key (as if it were plaintext) with an OTP key. Then I send the encrypted AES-key to ...
1
vote
1
answer
92
views
Understanding symmetric encryption security in relation to password-based key derivation
Here are some assumptions on which the question is based. If anything is wrong with this, please point this out straight away:
Let's say I have a file I want to encrypt with AES256 symmetric ...
2
votes
2
answers
370
views
Protecting against CPA for AES128/ECB by using padding
I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA.
So I thought about preventing CPA by padding input text to a multiple of 16 bytes.
First, perform custom padding system: ...