(or Advanced Encryption Standard), a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
20
votes
4answers
2k views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper (via Schenier on Security's Another AES Attack) (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
10
votes
3answers
897 views
Known methods for constant time (table-free) AES implementation using 'standard' operations?
There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
10
votes
2answers
997 views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
10
votes
3answers
542 views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
9
votes
2answers
541 views
Blum Blum Shub vs. AES-CTR or other CSPRNGs
Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
9
votes
3answers
398 views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity ...
9
votes
5answers
482 views
How do I construct a 256-bit hash function from 128-bit AES?
I would like to generate a 256-bit hash on a microcontroller that has a 128-bit (only) AES engine. How can I construct a 256-bit hash function from a 128-bit cipher?
9
votes
2answers
517 views
Design properties of the Rijndael finite field
So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other ...
7
votes
4answers
1k views
What is the effect of the different AES key lengths?
How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
7
votes
2answers
416 views
Does AES have any fixed-points?
Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?
If yes, how do I go about (efficiently) finding such a pair?
7
votes
2answers
2k views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
7
votes
1answer
5k views
What is safer: ZipCrypto or AES-256?
Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
7
votes
1answer
449 views
Replacing the Rijndael S-Box?
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
6
votes
2answers
498 views
Can one implement AES on 4-bit microcontroller?
It is possible to implement AES on 4-bit microcontroller? As far as I know, AES on 8-bit microcontroller are common especially for light weight application such as the RFID.
I have yet to come across ...
6
votes
3answers
402 views
Is it possible to distinguish a securely-encrypted ciphertext from random noise?
Say I have a bunch of data encrypted with a secure block cipher (such as AES). An attacker has unlimited access to this encrypted data. The attacker doesn't know whether the data is encrypted or if ...
6
votes
1answer
370 views
Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)
Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
6
votes
1answer
380 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
6
votes
1answer
580 views
AES and perfect ciphers
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.
Obviously AES isn't a perfect cipher, since the ...
5
votes
3answers
357 views
Why is OCB-AES mode not becoming a standard for authenticated encryption?
The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC ...
5
votes
2answers
645 views
How to calculate an IV when I have a shared private key?
I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
5
votes
4answers
215 views
Encrypting a key with the same key
I am new to crypto and trying to understand why it would be insecure to use AES to encrypt a key with the same key.
Basically, something like this:
encrypt(key, key)
What happens when both key and ...
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
5
votes
2answers
382 views
Where can i get the info to implement AES?
I know there are 100's of AES programs and websites out there but I can't seem to find a site that give me the detail I think I would/should need to write my own java program.
I was to write AES form ...
5
votes
1answer
228 views
How to enhance randomness of AES?
I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here.
My problem is that the strings I encrypt are ...
5
votes
1answer
1k views
How do I correctly derive a Key and IV?
Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class).
This encryption code will be used in conjunction with existing ...
5
votes
2answers
224 views
Should I salt an AES password at each encryption?
I saw a sample code where the same password is salted with a different value (using PBKDF2) for each encryption. That means that the salt must be stored for each encrypted message.
I don't understand ...
5
votes
2answers
141 views
AES encrypting multiple files
So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
5
votes
3answers
461 views
How can my application make sure the right symmetric key is used for decryption?
I am developing an Encryption/Decryption Utility using Adobe AIR. I have chosen the AES algorithm and currently use the as3crypto library for this. My query is in ...
5
votes
1answer
289 views
XSL on serpent and rijndael - which is most affected?
So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
5
votes
1answer
332 views
Related-key attacks on AES
According to Wikipedia:
Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively.
What are the requirements for these attacks (i.e how many ...
5
votes
2answers
187 views
Is encrypting a single 128 bit block with AES ECB “safe”
I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
5
votes
1answer
254 views
CBC key lifetime, or, “how big is too big?”
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
5
votes
1answer
626 views
GPG symmetric encryption and javascript
I have a use case where I need to encrypt some text in the browser using javascript. Only the encrypted text will be stored on the server.
The user should then be able to take the encrypted result ...
5
votes
1answer
577 views
Is the AES Key Schedule weak?
After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable.
In the paper the ...
5
votes
3answers
1k views
Is there any opensource white-box implementation of AES or DES?
I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided.
The same page also links various papers about ...
4
votes
4answers
471 views
How to require two keyholders to decrypt a document?
I want to create a system to encrypt a document and store it with a 3rd party, but not have the 3rd party be able to decrypt it until some unspecified later date. It seems like the solution would be ...
4
votes
2answers
209 views
Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
4
votes
3answers
767 views
Are there any simple and yet secure encryption algorithms?
Being very new to C++ and cryptography, I finally managed to implement a version of the Vinegere algorithm. I would like to try something a bit more complicated. I have looked at AES and DES and ...
4
votes
1answer
203 views
Why exactly is Blowfish faster than AES?
I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
4
votes
1answer
101 views
What is 'security margin'?
I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, ...
4
votes
1answer
71 views
Security for IV in AES-GCM mode
I'd like to use AES-GCM instead of HMAC for authentication and privacy in a token used in a web application, but I'm unsure how to securely tag each token with an IV. Is it safe for me to prepend the ...
4
votes
1answer
186 views
Is it secure to use the hash of key as the IV in AES encryption?
I need to store some sensitive data for a program. For each copy of the program, there will be a unique key for encrypting one (and only one) file using AES encryption (OFB). The key will not be ...
4
votes
1answer
296 views
How was the complexity of the Biclique Attack calculated?
The abstract of the Biclique Attack paper claims:
The first key recovery attack on the full AES-128 with computational complexity $2^{126.1}$.
What does $2^{126.1}$ mean in this context? And ...
4
votes
1answer
203 views
AES timing attacks
I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
4
votes
1answer
503 views
S-box design criteria and random sboxes
What are the disadvantages of using random s-boxes?
In AES, the s-boxes had to obey certain mathematical rules, which? And why?
What security does using hidden s-boxes (GOST) or generating them from ...
3
votes
2answers
204 views
Does AES specify error messages when using the wrong password to decrypt?
I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
