AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

5
votes
1answer
504 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
5
votes
2answers
2k views

Is encrypting a single 128 bit block with AES ECB “safe”

I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
5
votes
1answer
1k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
5
votes
1answer
198 views

At what point does passphrase strength match the strength of the cipher?

Let's say that I have an ordinary hard drive encrypted with VeraCrypt 1.0e full disk encryption and implementing: -AES -RIPEMD-160 Hash Algorithm Now let's say that for an arbitrary machine, the ...
5
votes
1answer
517 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
5
votes
0answers
74 views

Why is AES-SIV not used, but AESKW, AKW1?

I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ...
5
votes
0answers
333 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
4
votes
3answers
878 views

Is there any area where AES-CBC cannot be used ? If so, why?

I would like to know the domains or specific applications where using AES-CBC is not advised due to any drawbacks like sequential encryption of AES-CBC ?
4
votes
1answer
601 views

Why does “2xAES-256” provide “99.99%” security strength whereas “1xAES-128” provides “40%”? [closed]

I recently was "directed" to FlipsCloud, a company selling security solutions (as far as I can tell). In particular I've investigated their page and found a page on their "encryption features". This ...
4
votes
2answers
415 views

Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
4
votes
2answers
11k views

Why we can't implement AES 512 key size?

Out of curiosity why we can't implement AES 512 key size? Please explain somehow i can understand! I'm not an expert.
4
votes
2answers
309 views

Should I bother implementing DH + AES, or leave it to a library like Crypto++

I'm making a C++ back end for an application that'll heavily rely on AES-256 and DH. Should I trust third party libraries, or spend (lots of) time to learn about cryptographic implementation and write ...
4
votes
2answers
300 views

Security of the shared secret key for a smart meter (Linky)

Reading the specs of a new electricity smart meter (called Linky in France), I was surprised about the chosen encryption method (128 bits symmetric key AES), based on a single secret key (called CCC ...
4
votes
1answer
734 views

Can I use my random IV (for AES) as a salt for PBKDF2?

Also, where do I store my salt (can I just store it at the beginning of the encrypted file)?
4
votes
2answers
10k views

Cipher Feedback Mode

I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC. Can someone explain to me how CFB works. Such as how ...
4
votes
2answers
2k views

Keeping IV secret for AES CFB mode

I'm developing a security/encryption software and I'm using AES CFB (block size: 16 and key size: 32 bytes). I want to know, if I also keep IV (32 bytes) secret like the key itself (32 bytes), would ...
4
votes
1answer
267 views

Can the AES encryption and decryption algorithms be described as a polynomial for a specific key?

AES is a block cipher that consists of non-linear and linear parts to provide the Shannon requirements of confusion and diffusion respectively. The linear parts can for sure be described as a ...
4
votes
2answers
727 views

Does AES-128 have the same strength as AES-256 with a padded key?

When I use the same 128-bit key for AES-128 and AES-256 with a known/public padding for the latter, is there some weakness in AES-256 that is not present in AES-128 with essentially the same key? ...
4
votes
2answers
884 views

How secure is the AES master key if Round Keys are found

If an attacker finds some round key of AES256, is it possible to find the master key? How safe is the master key if an attackers finds multiple round keys?
4
votes
3answers
5k views

AES-GCM and its IV/nonce value

I was reading about the differences between the GCM and the CBC more here and I have a follow up doubt on the same. In the CBC mode the person who performs the encryption is the one who provides the ...
4
votes
1answer
14k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
4
votes
2answers
127 views

For what does “Rcon” stand for in Rijndael/AES?

How do we expand the abbreviation “Rcon” used in the Rijndael key schedule? I know what it is, I know how it works; I just do not know for what it is a shortcut for. I mean: if "Sbox" is ...
4
votes
1answer
333 views

What is considered a “weak key” in AES?

I need to construct an AES key from an array of bytes (in Java), but I first I have to check if the key created from these bytes would be weak. Java can check for weakness for DES, but not for AES. ...
4
votes
1answer
156 views

CBC-MAC just to verify integrity

I have a message and I want to verify its integrity and authenticity. I have a shared secret (key) that is not used for other encryption. Is it safe to send a plaintext message containing all the ...
4
votes
2answers
289 views

Can a 1 byte difference in AES 128 bit keys make huge difference in output?

If we take some randomly generated key of AES-128 and we change any random 1 byte of that 16 byte key, will this make huge difference in the AES cipher text generated over same input string? Does ...
4
votes
2answers
4k views

How exactly does AES-NI work?

I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI ...
4
votes
1answer
107 views

Authenticating Very Short (Sub-Block) Data

If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)? ...
4
votes
3answers
537 views

Is it secure to use Diffie-Hellman key agreement to generate a nonce?

I have a system, using AES, in one of the modes that uses a nonce and authentication. We have a pre-shared key, and to agree about initial nonce we could use Diffie-Hellman, using the resulting ...
4
votes
1answer
3k views

Is AES still secure considering all this NSA/Snowden scandal? [duplicate]

Im trying to understand if nowadays using AES is secure or not, after reading some arguments on Schneier’s blog (to be more exact, a comment to “The NSA Is Breaking Most Encryption on the Internet”) ...
4
votes
2answers
878 views

Increasing number of rounds in AES

AES-128 requires 10 rounds ( AES Description, Wikipedia ) However Bruce Schneier has recommended AES-128 use 16 rounds ( Schneier on Security: New Attack on AES ) Could that be implemented as two ...
4
votes
1answer
1k views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
4
votes
1answer
79 views

ChaCha20 immune to timing attacks

What are the reasons because of which ChaCha20 is immune to timing attacks ? Also why is not AES immune to timing attacks?
4
votes
2answers
401 views

Secure method for encrypting 32 byte private keys

I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the ...
4
votes
2answers
280 views

How to use salt when there is only one user

I am encrypting files for storage in an untrusted location, using a custom Java program to do that. There is only one user, but there are many files. I am using AES in CBC mode with PKCS5 padding, and ...
4
votes
2answers
145 views

Help with breaking AES reduced to 2 rounds

I was studying Rijndael AES proposal, and its cryptanalysis. I started with writing code to break AES reduced to 2 rounds. I am using 128 bit key size and 128 bit block size. 2 round AES means the ...
4
votes
1answer
204 views

Can Poly1305-AES be used with AES-256?

I'm reading through Bernstein's The Poly1305-AES message-authentication code. The MAC is predicated on 16-byte block ciphers like AES and produces 16-byte authentication tags. However, Bernstein does ...
4
votes
1answer
242 views

Swapping Key and IV in AES? Safe?

I have an application where I want to be able to send an encrypted file, and then mete out "keys" that allow the receipient to decrypt the file from a certain point to the end of the file. Actually, ...
4
votes
1answer
1k views

Visualization of cryptography

I think CrypTool is great software. And what I find most useful in it is visualization of algorithms such as Caesar, Vigenere, AES, DES. And my question is: does anyone know other tools which are ...
4
votes
1answer
386 views

Is it secure to use the hash of key as the IV in AES encryption?

I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be ...
4
votes
1answer
403 views

How was the complexity of the Biclique Attack calculated?

The abstract of the Biclique Attack paper claims: The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$. What does $2^{126.1}$ mean in this context? And ...
4
votes
2answers
85 views

Twofish MDS and PHT

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = ...
4
votes
1answer
44 views

How can bit slicing be constant time, when Mix Columns is in the cipher

I'm reading about bit-slicing techniques, and one thing about it caught my mind. The strength with bit sliced implementations are (apart from that they are fast) that they are running in constant ...
4
votes
2answers
185 views

Security of encrypting many short values with AES in GCM mode

We intend to encrypt certain values in a database which holds personal information such as addresses so as to prevent data leakage should the database be compromised. The intention is that each field ...
4
votes
1answer
84 views

Can I store the initialisation vector (IV) in the filename?

I'm encrypting a file and I'm using an initialisation vector. Given that the IV doesn't need to be a secret, is it secure if I add it to the encrypted file's name?
4
votes
1answer
90 views

AES storing the length within the encrypted data versus storing it outside

I need to strip off padding after decrypting AES(CBC)-encrypted data (I have control over encryption and data transmission), so have looked at adding the length of the original data to the payload ...
4
votes
2answers
3k views

Encryption of big files in Java with AES/GCM

I have to encrypt big files. Say their size ranges from 500mb to several of gigabytes. I would like to use AES/GCM/NoPadding as provided by Java 1.8 since that gives me automatic authentication and ...
4
votes
1answer
622 views

Any use for now-defunct Mt Gox Yubikey? [closed]

As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the ...
4
votes
1answer
236 views

AES: Is it safe to encrypt same cleartext with same key but with million diferent IV?

The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit. I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV. My ...
4
votes
2answers
2k views

Would a “Triple AES” (in the sense of how Triple Des works) serve for a dramatic increase in safety?

The system requires to be as paranoid as possible regarding security. One of the few contemplated changes to the current design is to use multiple encryption. First proposal was to use Serpent on top ...
4
votes
1answer
137 views

Security implications of using constant string to verify AES key?

I know that you can use for example CBC-MAC to verify data integrity and thus the password upon decryption. But would there be security implications of just adding a constant string to the plaintext ...