Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

AES S-Box design goal [duplicate]

First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
Mohammadsadeq Borjiyan's user avatar
0 votes
1 answer
191 views

Linear approximation table of AES S-Box

I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
Cat Dragon's user avatar
5 votes
3 answers
1k views

Theoretical Approaches to crack large files encrypted with AES

I have a large file (> 200 Gb), that I encrypted a while ago with AES-256-CBC. The file itself is a tar which I ran through ...
Sumuk Shashidhar's user avatar
1 vote
1 answer
71 views

Secure encryption in the presence of a keyservice

Imagine this scenario: On a particular PC is a service that provides cryptographic functions -- in particular AES-CBC and ECC (ECIES/ECDSA). The service provides access to a single key stored in an ...
Miral's user avatar
  • 113
1 vote
0 answers
78 views

How does changing one of AES encryption stages affect its security?

With regard to AES encryption on blocks, the next diagram showcase how does a change in one cell in the block (every cell is a byte) creates a change in encryption for ALL cells: Now I have the next ...
sadcat_1's user avatar
  • 111
1 vote
1 answer
121 views

AES CBC with random IV but key from PBKDF2 with same salt

TL;DR: Is encrypting data with AES CBC with random IV + PBKDF2 key using the username as salt safe? I have searched the internet, but I could not find a proper answer that encompasses the "AES ...
Daniel Aguiar's user avatar
4 votes
1 answer
210 views

How to determine cryptographic properties of AES S-Box?

In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
Cat Dragon's user avatar
0 votes
1 answer
176 views

If ChaCha20 only has 128 bits, is it secure?

ChaCha20 also provides 256-bit encryption, i.e, 2^256 possibilities of keys. But ChaCha20 is very fast, I think it provides at most 2^256 multiplied by decrypting time. 256-bit AES provides 254-bit ...
Flan1335's user avatar
  • 361
1 vote
0 answers
52 views

What happens if the column mixing in AES is replaced by simple XOR and subtraction? [closed]

This is https://github.com/kokke/tiny-AES-c The column mixing function in the AES algorithm implemented. ...
S-N's user avatar
  • 127
1 vote
1 answer
172 views

Where in the TLS 1.3 record is the sequence number located?

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
miran80's user avatar
  • 113
0 votes
1 answer
52 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 113
1 vote
1 answer
660 views

Example of S-Box truth table in AES

I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say A boolean function S : $ GF(2^n) $ ...
Cat Dragon's user avatar
3 votes
1 answer
723 views

How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?

Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it. My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
ceaaj's user avatar
  • 33
2 votes
1 answer
936 views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
0 votes
0 answers
36 views

How do different encryption schemes scale as a relation between their security parameter and computational requirement?

For example is it harder to break one 256 bit encryption than two 255 bit encryption for RSA and AES? For example, I understand that 256 bit RSA can be cracked in one minute according to this article [...
mnaei's user avatar
  • 1
5 votes
2 answers
116 views

How to prevent power analysis on software level?

When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
user109190's user avatar
0 votes
0 answers
84 views

Is it safe to store AES-KW encrypted key in database?

Use Case: Web application accessed in browser. Registered users can store personal notes in the application, these notes are stored in a SQL database on a online server. The user can store unencrypted ...
user avatar
0 votes
0 answers
66 views

Password Manager desktop app

I have built a small password manager desktop app using python. This app falls under the master-password model.The app connects to two databases stored locally. The first database stores the users ...
StavrosN's user avatar
0 votes
0 answers
145 views

How to use NIST SP 800-22 to check randomness of 128 bits output in AES?

I am trying NIST SP 800-22 to test the randomness of 128 bit output in AES, but i always get igamc: UNDERFLOW or Segmentation fault (core dumped) error. My data file has 128 bit output format, for ...
Cat Dragon's user avatar
2 votes
0 answers
93 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
1 vote
1 answer
387 views

How long time per operation to crack Kyber1024 compared to AES256 for quantum computers?

How long time does quantum computers take per operation when search the key of Kyber? Grover's algorithm weakens 256-bit AES to 128-bit security, quantum computers at most take 2^128 operations to ...
Flan1335's user avatar
  • 361
2 votes
1 answer
78 views

How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?

I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows: Design criteria for $S_{RD}$. We have applied the following design ...
Cat Dragon's user avatar
2 votes
1 answer
137 views

AES encryption IV that won't need to be stored

I'm trying to implement an IV that won't need to be stored on it's own. I'm considering 3 options: Since I'm using PBKDF to generate a key I could use some bytes from the generated hash I could use ...
snow's user avatar
  • 23
1 vote
1 answer
41 views

Using Self-Generated Random Bits Instead of the Initialization Vector (IV)

I think my understanding on initialization vector (IV) might be lacking, but as I understand it, an IV is used to create randomness to an encrypted message so that the message is difficult to crack ...
Jarron's user avatar
  • 113
0 votes
1 answer
112 views

Finding block mode and key length from encrypted data

I have an AES encrypted data and the key, but I am not able to tell the block cipher mode [ECB|CBC|CTR] used in encryption or know the key length. Below is the encrypted data output in java. ...
Aviril Smith's user avatar
2 votes
1 answer
59 views

What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper. I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
siba36's user avatar
  • 301
0 votes
1 answer
69 views

Use name as the initialization vector to encrypt passwords for users

I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
troubleddev's user avatar
0 votes
0 answers
36 views

Is it possible to generate a read-only key for a symmetrical encryption (AES)?

I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable, without the encoding key being exposed. This is the textbook use-case ...
Koray Kaya's user avatar
1 vote
2 answers
1k views

AES-GCM and tag length

Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding. For instance, if ...
EmbeddedEnthusiast's user avatar
0 votes
1 answer
60 views

Clarification regarding AES-CTR

I was recently trying to perform a AES-128 CTR Encryption and Decryption. I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
gabbar's user avatar
  • 1
2 votes
1 answer
40 views

Threshold of resistance against Linear Cryptanalysis

In the AES proposal, the last sentence on page 30 it is said: To be resistant against LC, it is a necessary condition that there are no linear trails with a correlation coefficient higher than 2^(n/2)...
Abdelrahman's user avatar
4 votes
1 answer
77 views

Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
siba36's user avatar
  • 301
1 vote
2 answers
98 views

Encrypting Small messages (BLE Beacon) - with little entropy - symmetric [closed]

I want to encrypt Bluetooth Beacon data. I was wondering if having very little entropy in the clear text would make the key easier to guess? The maximum data length is 31 bytes An example of the data (...
BAO's user avatar
  • 13
6 votes
3 answers
8k views

Can Quantum Computers crack RSA and AES?

Im trying to learn more about cryptography and ran into a post, Is AES-128 quantum safe?, which asks if AES-128 is safe. From the articles and replies it seems that AES-128 (symmetric key) is safe ...
cryptoman534345's user avatar
1 vote
0 answers
74 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
Luce's user avatar
  • 11
2 votes
1 answer
83 views

When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?

I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
alpominth's user avatar
  • 393
2 votes
1 answer
87 views

In AES, why do we multiply the columns by a polynomial with a repeating coefficient?

In the MixColumns step of AES, one multiplies each of the columns of the $4\times 4$ box of bytes by the polynomial $a(x)=\{03\}x^3+\{01\}x^2+\{01\}x+\{02\}$ (modulo $x^4+1$). But in this polynomial, ...
Joseph Van Name's user avatar
2 votes
1 answer
334 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
sWong's user avatar
  • 29
2 votes
1 answer
256 views

Application firmware sign-then-encrypt vs encrypt-then-sign

I know that there are previous questions on the subject e.g. here, however I would like to ask it for my particular (simple) case. I have an application firmware that is downloaded to a microprocessor ...
Fabius Wiesner's user avatar
3 votes
1 answer
98 views

GCM-SIV vs CBC with fixed IV?

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
Paul's user avatar
  • 31
1 vote
0 answers
162 views

RSA Key Generation & encrypted output using OpenSSL

When is it generally acceptable, if ever, to generate RSA keys without encrypting the PEM output with another encryption algorithm? I am working on a CI/CD process and want to leverage asymmetric ...
Johnny Bass's user avatar
0 votes
0 answers
118 views

Problem in matching AES CTR encryption and decryption with two different engines

I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
Fabius Wiesner's user avatar
0 votes
1 answer
147 views

Do multiple keys mitigate Grover algorithm?

Grover, a quantum algorithm, weakens AES and ChaCha20. Is it possible to use multiple symmetric keys to encrypt a message multiple times to achieve 256-bit security for quantum computers?
Flan1335's user avatar
  • 361
0 votes
1 answer
173 views

How does AES-CBC encryption achieve non-repeating blocks of ciphertext?

I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
SN-Grotesque's user avatar
0 votes
1 answer
122 views

Implementing AES GCM but not getting correct output from cipher block

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect). When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
user997112's user avatar
0 votes
1 answer
123 views

AES GCM Difference between the IV and the Secret Key?

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter. The GCM specification examples state both an IV and a Secret Key as two inputs. Can someone please explain ...
user997112's user avatar
1 vote
1 answer
208 views

What is Inverse equivalent (decrypt) in the AES specification examples?

Referring to the AES specification: https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf Printed pages 35-37... The first detailed walkthrough is encryption, the second is decryption.... I don't ...
user997112's user avatar
2 votes
0 answers
105 views

AES key encryption on one time pad

I need to use the following scenario: There are 2 keys: AES-key and OTP-key (one-time pad). I encrypt the AES-key (as if it were plaintext) with an OTP key. Then I send the encrypted AES-key to ...
Ss1996's user avatar
  • 53
1 vote
1 answer
92 views

Understanding symmetric encryption security in relation to password-based key derivation

Here are some assumptions on which the question is based. If anything is wrong with this, please point this out straight away: Let's say I have a file I want to encrypt with AES256 symmetric ...
xsw2_2wsx's user avatar
2 votes
2 answers
370 views

Protecting against CPA for AES128/ECB by using padding

I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA. So I thought about preventing CPA by padding input text to a multiple of 16 bytes. First, perform custom padding system: ...
kakacar's user avatar
  • 23

1 2
3
4 5
53