(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

learn more… | top users | synonyms

6
votes
1answer
543 views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
2
votes
1answer
199 views

Since it gives negative power, how is rcon(0) calculated in AES?

I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation ...
2
votes
1answer
520 views

Two different approaches for Key Expansion using the AES-256 algorithm?

I am implementing AES 256-bit Algorithm from the Theory given in the book, "Cryptography and Network Security" by Behrouz A. Forouzan. The Algorithm described in the Book in relation to ...
5
votes
1answer
229 views

Initialization Vector Properties

This is a multi-layer problem, and I want to take you through the whole thing rather than just asking about IVs. Bear with me. Also, all code below is in Common Lisp because that's what I'm using, but ...
2
votes
3answers
358 views

Can one build a one-way function from AES?

We change the AES block cipher encryption: we delete the key schedule algorithm the user now provides a string of 1408 bits we divide the string to 11 sub keys, and use them directly in the ...
1
vote
2answers
2k views

How does GCM (Galois/Counter Mode) work? [closed]

Can somebody explain how this mode works? What view has cipher text and how does it help to authenticate input’s data?
0
votes
1answer
126 views

Is AES a linear hash?

So, having read a variety of documentations on AES encryption, I came to the unknowledgeable conclusion that the key schedule applied to the array of chunks, and not just the 14 cycles on a single ...
4
votes
1answer
3k views

How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over GF(2^8), but I'm confused by the description of the affine transformation. I ...
2
votes
1answer
809 views

How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
2
votes
2answers
282 views

Do we have to use an IV for AES encryption to be FIPS 140-2 compliant?

I asked this question Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation here before and although there are some different thoughts about this, the general consensus ...
1
vote
0answers
106 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
6
votes
2answers
1k views

Will our app be FIPS 140-2 compliant if we use our own AES algorithm implementation?

We are in the processing to understand if our software applications is FIPS 140-2 compliant or not. Currently in our application, we are using our own implementation of AES algorithm. AES is a FIPS ...
1
vote
1answer
242 views

Key-size of encryption method

Is there a definied keysize to be used with the "AES_256-CBC" method in PHP, and what is the size? Some background: I want to store encrypted text into a PostgreSQL database. The user who posts the ...
2
votes
0answers
439 views

How do I enable AES-NI (hardware acceleration) for Node.js crypto on Linux? [closed]

I wrote a basic function to test the speed of the AES-256-CBC mode of the Node.js built-in crypto functions. These functions use OpenSSL, so they should support AES-NI, but when I correctly enable ...
1
vote
2answers
161 views

What is the intuition behind AES or SPN?

I'm new to cryptography and have just encountered AES and SPN. I would like to know how the S-box, permutation step and the MixColumn step help improve security. It seems to me (perhaps mistakenly) ...
3
votes
0answers
254 views

AES file encryption with PBKDF2. Safe parameters?

I'm developing an application that will use public key authentication to contact some webservice. So the user has his keypair on his computer, and I want that file to be encrypted using AES with a key ...
2
votes
1answer
302 views

How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
3
votes
2answers
346 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
1
vote
2answers
323 views

How do we prove that AES, DES etc. are secure?

How do we prove that AES, DES etc. are secure? I've read about them and know the basics on how they work, but I still don't quite understand how we can be sure they are secure? What are the proofs?
4
votes
1answer
199 views

AES-CTR with ephemeral keys vs IV

Let's say that we have a key exchange of some sort, which leaves A and B sharing the long-term secret $S$. Then, A and B want to use AES-CTR for the communication, which leaves us with several ...
5
votes
2answers
2k views

Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

I've done research about this subject, but I can't find the answer I'm looking for. The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during ...
12
votes
2answers
2k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
2
votes
1answer
245 views

Increase number of rounds for SPN and Feistel ciphers

Read a post on Schneiers blog (and again 2011) about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. ...
6
votes
4answers
2k views

Is there any opensource white-box implementation of AES or DES?

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided. The same page also links various papers about ...
10
votes
2answers
783 views

Why was the winner of the AES competition not a Feistel cipher?

The winner of the AES competition has a structure that does not qualify as a Feistel cipher, as explained in answers to this recent question. However, most many of the AES candidates, and all 3 out ...
3
votes
2answers
1k views

Why is AES not a Feistel cipher?

I am studying for an exam right now. And I wanted to make sure I got this point correct. AES is not a Feistel cipher because the operations in AES are not invertible. Is the above statement ...
6
votes
2answers
593 views

What is the security loss from reducing Rijndael to 128 bits block size from 256 bits?

As you know in the past few weeks it has emerged that NIST/NSA have been involved in weakening encryption standards over a long period of time so that they can retain the ability to break encryption ...
6
votes
2answers
1k views

GPG symmetric encryption and javascript

I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server. The user should then be able to take the encrypted result and ...
3
votes
2answers
412 views

Are there public slow-but-strong algorithms out there that resist brute-force attacks better?

I'm reading that AES uses 4x4 bytes (4*4*8 = 256 bits key) matrix for performances matters (since it's a requirement for common standard encryption algorithms), but are there implementations with ...
1
vote
1answer
2k views

Counter Mode in Advanced Encryption Standard(AES) Algorithm

In Advanced Encryption Standard, if I used "Counter Mode", how should I handle the nonce? Should I divide the nonce value into two? For example: I have 128-bit of nonce, should I divide it so I get ...
2
votes
1answer
233 views

Is it safe to use GZIP to avoid padding related attacks

I am designing a library that supports encrypting some in-memory data using AES in CBC mode. Now I need a padding but it seemed to me that Apple's CommonCrypto library and OpenSSL have different ...
1
vote
2answers
587 views

Achieving 256-bit encryption strength with PBKDF2 - HMAC-SHA1

I am interested in the theoretical consideration of the bit strength of an encryption key and its precursor. Assume a given environment as follows: a. My encryption algorithm is AES-256 b. My key ...
3
votes
1answer
322 views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
7
votes
1answer
2k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
1
vote
1answer
590 views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
3
votes
1answer
223 views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
8
votes
2answers
644 views

Can one implement AES on 4-bit microcontroller?

It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID. I have yet to come across ...
4
votes
1answer
250 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
1
vote
1answer
396 views

Proper way of doing encryption and authentication (PBKDF2 + AES)

I'm currently in the planning phase of an authentication and storage-ish service. The client needs a file ("ENCFILE") which he will work with. This file will be encrypted with AES256, and stored on ...
1
vote
0answers
41 views

one-time key, zero IV in stream cipher (e.g. AES-CTR) [duplicate]

Say I am using a random key to construct a stream cipher with, say, AES in CTR mode, which will never be used to encrypt more than one data stream. Is there any advantage, no matter how small, to ...
2
votes
1answer
368 views

AES with different modes of operation

I'm taking up a cryptography class and this is for an assignment. We're asked to find the differences between AES/RSA in the different modes of operation vs the one timepad method. From wiki, I can ...
14
votes
4answers
6k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
8
votes
3answers
243 views

AES CTR with similar IVs and same key

Lets say there is a piece of software that uses AES CTR to encrypt different messages using the same key but with slightly different IVs So for example, a 16 byte IV, the 2nd 8 bytes are always the ...
2
votes
4answers
1k views

Initialization vector in symmetric-key encryption

Can we use symmetric-key algorithms without an initialization vector? I am making an app where both the sender and receiver share a key and there is no way to create an initialization vector for each ...
6
votes
2answers
187 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
6
votes
1answer
803 views

Is AES-XTS considered safe to encrypt multiple files with the same keys?

I was wondering if changing the cipher mode to AES-XTS in EncFS would be a sound idea. EncFS uses AES in CBC mode until the last 1KB block, and CFB mode for the last block if ...
1
vote
2answers
209 views

How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
2
votes
1answer
138 views

Multiple parties must encrypt and get the same result

Hopefully this question is not too simple - I did some research but with encryption I really don't want to make a mistake. Our scenario is that multiple groups need to encrypt a number and arrive at ...
1
vote
1answer
242 views

Is the salt value a secret or can it be stored in cleartext just like the IV? [duplicate]

From Wikipedia I read that the IV is used to randomise the mapping of cleartext to cipher text and that the IV is usually stored (in cleartext) together with the encrypted record. ...
2
votes
1answer
777 views

Am I insecurely implementing AES in Python? [closed]

My name is Pat, I'm a rising high school senior interested in Comp Sci. I've taken interest in cryptography following the NSA scandal. Since this is the first time I've ever implemented encryption ...