(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

3
votes
1answer
389 views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
3
votes
2answers
987 views

Validating successful decryption in AES

I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
3
votes
1answer
543 views

Advanced Encryption Standard Algorithm Secret Key

just a follow up question with this question.. How does the key schedule of Rijndael looks for keysizes other than 128 bit? A 256-bit key can still encrypt a block of plaintext in 128 bit? but in ...
3
votes
3answers
2k views

Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
3
votes
2answers
82 views

CBC-MAC key can be added to ciphertext?

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC. Does the second key (for CBC-MAC) need to be secret? How to join such key with the ...
3
votes
1answer
248 views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
3
votes
1answer
254 views

How does the IV or initial counter increase internally for each block in AES CTR mode?

I am working on Intel AES-NI library and since the AES function is coded using low-level assembly instructions. I could not see how the IV or initial counter increases in CTR mode. In general, how ...
3
votes
1answer
407 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
3
votes
2answers
577 views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
3
votes
1answer
920 views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
3
votes
1answer
329 views

Is symmetric encryption vulnerable to plain-text-attacks?

Imagine that Bob sends a message to Alice for symmetric encryption to send to Charlie. (Only Alice and Charlie know the key.) Alice sends the encrypted message back to Bob to send to Charlie. Can Bob ...
3
votes
1answer
276 views

AES with weak keys

Suppose that the key generation is insecure; each key bit is independently generated, but the value of each key bit is '$1$' with probability $0.90$. These keys are used in AES. What is an efficient ...
3
votes
1answer
281 views

Why does AES-GCM need MAC? (TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)

"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" is just one example for a cipher suite, as far as I'm concerned it means this: it uses the TLS protocol, exchanges keys with Elliptic Curve Diffie Hellman ...
3
votes
1answer
101 views

Performance for Subbytes in AES

I´m implementing the AES-encrypt algorithm for the SSE2 instruction set. For the Subbyte function i use movzx, having loaded ...
3
votes
1answer
104 views

Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt… Suppose I have 2 different keys: secretkey1 secretkey2 And a plain text: myReallySecretPlainText If I use AES128 ...
3
votes
2answers
272 views

How is the AEScrypt password related to the underlying AES key

AES uses a key that is at most 256 bit. I assume AESCrypt uses AES. When a file is encrypted with AEScrypt, there is no limit to the length of the password. What is the relation between the ...
3
votes
2answers
430 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
1answer
241 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
3
votes
1answer
139 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
3
votes
1answer
515 views

Visualization of cryptography

I think CrypTool is great software. And what I find most useful in it is visualization of algorithms such as Caesar, Vigenere, AES, DES. And my question is: does anyone know other tools which are ...
3
votes
1answer
1k views

Implementing AES encryption for firmware distribution system

I need to implement an AES encryption for firmware distribution system. I have a bootloader that can decrypt various AES variants (ECB,CBC,CTR). When I approached this I found few issues that aren't ...
3
votes
1answer
370 views

Is truncating a hashed private key with SHA-1 safe to use as the symmetric key for AES for data at rest?

I realize this is mixing the purposes between asymmetric and symmetric crypto, but I was wondering if it is safe to use a hashed, truncated private key (asymmetric) as the symmetric key for encrypting ...
3
votes
1answer
204 views

Attacks on AES-128 (ECB) based on some knowledge of plaintext

I'm working with a third party protocol which employs AES-128 in ECB mode of operation to encrypt a packet composed of 16-byte blocks (it encrypts each block independently). I'm trying to determine if ...
3
votes
1answer
258 views

How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as: $$ \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ...
3
votes
1answer
304 views

ECC public key encryption and authentication - ECIES with ECDSA vs ECDH with AES

I'm currently working on a project where I want to establish a secure and authenticated communication channel between to entities, using Elliptic Curve Cryptography. Now I'm not really sure how to ...
3
votes
1answer
329 views

Any use for now-defunct Mt Gox Yubikey?

As everyone is now aware, Mt Gox has declared bankruptcy. As what appears to be the very last thing they did, Mt Gox accepted my $35 and fulfilled my special Mt Gox Yubikey. Having just arrived in the ...
3
votes
1answer
151 views

AES: Is it safe to encrypt same cleartext with same key but with million diferent IV?

The encryption mode that I am using is CBC. Algorithm is AES and the key size is 128bit. I will be encrypting a 36 byte string over 1.3 million times with the same key but with a random IV. My ...
3
votes
1answer
232 views

How is an AES Encrypted Message Decrypted with Random Padding?

One thing I was surprised to learn about AES is that random padding can be added to the message to make it a multiple of block size. What I can not wrap my head around is how this random padding can ...
3
votes
2answers
197 views

How to Compute C^2 in AES MixColumns Matrix?

In mix Columns we have: $$C(x) = \{03\}X^3 + \{01\}X^2 + \{01\}X^1 + \{02\}$$ In Viktor Fischer's Paper on MixColumn and ...
3
votes
1answer
989 views

Winzip AES256 vs PGP

If I use the AES256 option in Winzip to encrypt a file, is it any less safe or less secure than using pgp encryption?
3
votes
1answer
323 views

Counter Mode: static IV but different keys [duplicate]

Given we are using AES counter mode, suppose we randomly generate several keys, all of them are using same IV (say, zeros). Does this lead to any security issue? I know that in CTR mode, same key-iv ...
3
votes
2answers
569 views

Implementing PKCS#7 Padding on a Stream of Unknown Length?

I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
3
votes
1answer
796 views

On-the-fly computation of AES Round Keys for decryption?

The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that ...
3
votes
1answer
3k views

Advantage of AES(Rijndael) over Twofish and Serpent

I'm trying to figure out a suitable encryption technique and after reading a bit, I figured the current AES 128-bit encryption is suitable for what I'm trying to do. However, this is more due to the ...
3
votes
1answer
91 views

Last Round in DES

I am studying DES for my Cryptoexam .As far as I understood , the initial plaintext is permuted and then the left half is called L0 and Right half is called R0. After that for each round the process ...
3
votes
1answer
217 views

Entropy test for AES Key Schedule

According to the article "Lest We Remember: Cold Boot Attacks on Encryption Keys" there is a quick and dirty entropy test that can help to find possible AES Key Schedules in memory dumps. Although ...
3
votes
1answer
179 views

TLS: Is Integrity assured when using NULL cipher

In specific implementation we're using TLS 1.0, open ssl 0.9.8 but i'm referring to RFC 5246. For performance reasons, I'm being asked if we can use TLS without encryption. The hope is that the ...
3
votes
1answer
146 views

implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
3
votes
2answers
692 views

Using an RSA private key simultanously as an AES encryption key to generate random numbers?

Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the successor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
3
votes
1answer
160 views

Efficient AES - Use of T-tables

I'm really in trouble! I'm trying to understand how the T-tables in AES encryption work. But I don't know if I get the point. What I understood is that they are used to reduce the whole computation of ...
3
votes
1answer
109 views

Possible CPA or CCA attack when using AES-CBC mode under the following situation?

Both client and server know a shared key in advance. Both sides us EVP_BytesToKey() derive a pair of same key and same IV. Then, client and server start transferring data encrypted by AES-CBC mode ...
3
votes
1answer
72 views

Convergent Encryption: integrity and authenticity

I have one question about convergent encryption. Suppose I use AES-256 in CBC mode. I need a 256 bits key and a 128 bits IV. If I use SHA-256 to hash one file, then I can use directly that hash as ...
3
votes
1answer
136 views

AES-128-CTR message integrity: Construction of HMAC

(Note: This post is not about "rolling my own", but rather trying to deepen my understanding of the underlying structures.) I'm having difficulties finding clear answers to some questions about the ...
3
votes
1answer
231 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
0answers
173 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
3
votes
0answers
295 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
3
votes
0answers
111 views

CBC with fixed IV but changing data [duplicate]

Possible Duplicate: Using CBC with fixed IV I am using AES in CBC mode. For some reasons I have some issues for transmiting the IV. So I am using a fixed IV. If the first 128bits of the ...
2
votes
3answers
330 views

Does AES CTR mode store header information in encrypted files?

According to the movable-type.co.uk website, In the ‘counter mode’ used in this implementation, a counter which changes with each block is first encrypted, and the result is bitwise xor’d with the ...
2
votes
2answers
381 views

Does AES with whitening mode have the following property?

This mode is that each time a random number $K$ is generated, you XOR it with plaintext $M$ and then pass the result to AES. Since AES is a pseudo random permutation, does AES have the following ...
2
votes
2answers
2k views

What characters does AES output?

From what I understand after testing the Crypto-JS file here: http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/aes.js AES creates encrypted strings that contained letters, both ...