(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

28
votes
4answers
10k views

What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
5
votes
2answers
485 views

What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?

As you know in the past few weeks it has emerged that NIST/NSA have been involved in weakening encryption standards over a long period of time so that they can retain the ability to break encryption ...
6
votes
2answers
912 views

GPG symmetric encryption and javascript

I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and ...
3
votes
2answers
384 views

Are there public slow-but-strong algorithms out there that resist brute-force attacks better?

I'm reading that AES uses 4x4 bytes (4*4*8 = 256 bits key) matrix for performances matters (since it's a requirement for common standard encryption algorithms), but are there implementations with ...
1
vote
1answer
2k views

Counter Mode in Advanced Encryption Standard(AES) Algorithm

In Advanced Encryption Standard, if I used "Counter Mode", how should I handle the nonce? Should I divide the nonce value into two? For example: I have 128-bit of nonce, should I divide it so I get ...
2
votes
1answer
197 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
0
votes
2answers
509 views

Achieving 256-bit encryption strength with PBKDF2 - HMAC-SHA1

I am interested in the theoretical consideration of the bit strength of an encryption key and its precursor. Assume a given environment as follows: a. My encryption algorithm is AES-256 b. My key ...
3
votes
1answer
258 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
6
votes
1answer
1k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
1
vote
1answer
394 views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
4
votes
2answers
339 views

Why is AES considered to be secure?

The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA. ...
3
votes
1answer
200 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
7
votes
2answers
627 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
4
votes
1answer
185 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
1
vote
1answer
339 views

Proper way of doing encryption and authentication (PBKDF2 + AES)

I'm currently in the planning phase of an authentication and storage-ish service. The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
1
vote
0answers
38 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
2
votes
1answer
267 views

AES with different modes of operation

I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method. From wiki, I can ...
13
votes
4answers
5k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
7
votes
3answers
209 views

AES CTR with similar IVs and same key

Lets say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs So for example, a 16 byte IV, the 2nd 8 bytes are always the ...
1
vote
4answers
833 views

Initialization vector in symmetric-key encryption

Can we use symmetric-key algorithms without an initialization vector? I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each ...
5
votes
2answers
168 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
6
votes
1answer
593 views

Is AES-XTS considered safe to encrypt multiple files with the same keys?

I was wondering if changing the cipher mode to AES-XTS in EncFS would be a sound idea. EncFS uses AES in CBC mode until the last 1KB block, and CFB mode for the last block if ...
1
vote
2answers
200 views

How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
2
votes
1answer
132 views

Multiple parties must encrypt and get the same result

Hopefully this question is not too simple - I did some research but with encryption I really don't want to make a mistake. Our scenario is that multiple groups need to encrypt a number and arrive at ...
0
votes
1answer
178 views

Is the salt value a secret or can it be stored in cleartext just like the IV? [duplicate]

From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. ...
2
votes
1answer
618 views

Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption ...
4
votes
2answers
337 views

Implementing PKCS#7 Padding on a Stream of Unknown Length?

I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
6
votes
2answers
836 views

AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ? (The obvious answer would be ...
5
votes
2answers
428 views

Vulnerabilities if encrypting the same data with 2 different keys

Let's say that Alice and Bob complete a key exchange and then Alice uses that key k1 to encrypt a 256-bit key kaes1 and sends it ...
4
votes
2answers
194 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
9
votes
2answers
438 views

Can AES decryption be used as encryption?

Definition E: AES encryption D: AES decryption x: plain text y: encrypted text k: key In original AES cipher, encryption: y = E(x, k) decryption: x = D(y, k) Then I define the "reverse AES ...
5
votes
2answers
897 views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
3
votes
1answer
110 views

Could using sequential plaintext uncover AES key?

I am encrypting a string in a format like this: ...
4
votes
1answer
166 views

Swapping Key and IV in AES? Safe?

I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, ...
3
votes
2answers
146 views

How to Compute C^2 in AES MixColumns Matrix?

In mix Columns we have: $$C(x) = \{03\}X^3 + \{01\}X^2 + \{01\}X^1 + \{02\}$$ In Viktor Fischer's Paper on MixColumn and ...
5
votes
1answer
226 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
3
votes
1answer
182 views

Advantages of combined PRNGs

This question is related to this one in intention, and this one in scope. Would I be guarding myself against future attacks on a single PRNG if I combine two (or more) together? I am thinking of ...
1
vote
2answers
212 views

Derive a key from public data using a secret master key

Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. ...
5
votes
1answer
186 views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
4
votes
3answers
3k views

AES 256 Encryption - Is it really easy to decrypt if you have the key?

So this might sound like a crazy question but bear with me for a minute. I can't find any info on the internet and so am here, although this might have been a good place to start. I've recently ...
-1
votes
1answer
561 views

AES: keylength and password length? [closed]

What is the difference between the keylength and the length of a password for AES-256?
3
votes
1answer
199 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
1answer
101 views

How difficult is it to find the “pre-image” of a block cipher?

Say that I have $$ C_1 = AES_{k_1}(M_1) $$ How difficult would it be to find a key, K2 and plaintext M2 $$ C_2 = AES_{k_2}(M_2) $$ such that $$ C_1 == C_2 $$ How would using a block cipher ...
3
votes
1answer
158 views

Using same AES-GCM setup for multiple packets?

Most cryptographic libraries I've encountered uses some variant of processPlaintext(...) and then doFinal() to produce the ...
2
votes
1answer
342 views

Review of AES encryption concept for an open source project

i'm working on an opensource project, A generator for static (html/js), password protected photo galleries. The generator AES 256 encrypts many images with the same key in PyCrypto, and decrypt them ...
0
votes
1answer
128 views

What parts of AES encryption result are safe to pass on the network

I'm using AES to encrypt the message. both sender and receiver know the passphrase, but only sender knows IV and salt I assume that receiver also needs to know IV and salt to decypher text; is it ...
1
vote
0answers
88 views

openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
3
votes
1answer
130 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
10
votes
1answer
709 views

Windows 8/Server 2012: Passes FIPS-140-2 despite failing AES-GCM for IV != 96 bits long?

Background Microsoft certifies Windows 7/8 as well as Server 2008 R2 and 2012 to be FIPS-140-2 compliant. Actually they certify just a small crypto core, bcrypt.dll (the library, which is unrelated ...
1
vote
0answers
208 views

Non-malleable file encryption using AES XTS 256?

I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...