A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms (1)

4
votes
2answers
74 views

Chance of finding the right key by exhaustively searching on half of the key space

An exhaustive search of half the key space requires $2^{n-1}$ work and provides the right answer 75% of the time. If the attacker finds the key, he knows the answer. If he doesn't find the key, he ...
6
votes
2answers
212 views

Can I use a differential that can be traced through the whole cipher with 100% probability?

I'm trying to attack a very simple cipher using differential cryptanalysis as a way of becoming familiar with this method. The cipher is so simple that I've found a differential which I can trace ...
9
votes
2answers
483 views

How to deal with a cipher with addition and XORs combined together?

I am trying to cryptanalyze a cipher where bitwise XOR and addition mod $2^n$ are combined together. I've been working on it for a long time but with no result - the main difficulty, which I am unable ...
5
votes
1answer
47 views

How simple can the PRP used in the Even-Mansour scheme be?

For example, in the question “Is there any reason not to use Single-Key EM with AES and a constant key?” it is proposed to use AES with a fixed key as the permutation in a xor-permute-xor construction....
0
votes
1answer
27 views

Does the Blowfish cipher work with OFB mode?

I'm trying to implement the Blowfish cipher in Output Feedback mode. OFB mode has two operations, XOR and the block cipher. XOR inputs two blocks of the same length and outputs one block of the ...
3
votes
1answer
39 views

Proof for collision resistance on a block-based hash

I am designing an unkeyed hash based on the SIMON cipher. This is a follow up to “this” question. A quick summary: I have an ECC engine and the SIMON cipher in hardware, and it’s in an extremely ...
-2
votes
0answers
50 views

any post-shannon symmetric ciphers?

As far as I understand block ciphers use only simple operations to ensure good enough confusion and diffusion levels. meaning there is no math in it. "breaking a good cipher should require as much ...
1
vote
0answers
43 views

Countering Cryptographic Attacks

By reading Camellia Design and Analysis document following is my understanding about few cryptographic attacks from designer point of view. Differential and Linear Crypt-analysis. Number of Active ...
3
votes
2answers
606 views

How does blocksize affect security?

I have recently read about how blockciphers and how stream ciphers work, and although I think I finally got everything right, I'm still wondering how increasing blocksize increases security.
3
votes
2answers
65 views

Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...
1
vote
2answers
106 views

How to break a 32 bit block cipher without key?

From what I know Skip32 is the only 32 bit block cipher and I heard its not secure. What do I do or which tool do I use to break a 32-bit block cipher? I did search for this but all I find is attacks ...
1
vote
1answer
40 views

tweakable block cipher and ideal block cipher

Can the set of block ciphers obtained from a tweakable block cipher (using distinct tweaks) be considered as the set of ideal block ciphers ?
4
votes
2answers
63 views

Need for 3 rounds in Luby Rackoff theorem

I get that using Feistel network we can create a secure PRP from a secure PRF (in 3 rounds according to theorem). My question is why not just 2 rounds of Feistel network is sufficient. Is it that ...
2
votes
0answers
25 views

Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
1
vote
1answer
95 views

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

For example what can you say about how susceptible Triple-DES is to a birthday attack due to the fact that it has a block size of 64-bits.
4
votes
2answers
91 views

Twofish MDS and PHT

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = Minimum~of~[...
8
votes
3answers
175 views

How to prove the security of block ciphers

I see very often proofs of security for asymmetric crypto algorithms, for instance, using reductions to known hard problems, or game based proofs... In the field of protocols (like authentication) it ...
1
vote
0answers
59 views

Is 3 rounds more secure than 2 in this simplified DES?

Consider the following simplification of DES: a plaintext message block of $2n$ bits of length is divided into two blocks of length $n$ (left half $L_0$ and right half $L_1$). In other words, the ...
0
votes
0answers
99 views

Deoxys: disadvantages vs. AES?

The CAESAR candidate Deoxys is based on a tweakable block cipher that seems to be a strict improvement over AES, in that it is a tweakable cipher resistant to related-key attack. The mode proposed ...
2
votes
3answers
369 views

What is the fastest block cipher in the (Intel) world?

In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than ...
1
vote
2answers
165 views

How to crack unknown 8-bit encryption algorithm?

Can anyone tell me how to crack the encryption of 8 bit algorithm, when you have some clue that CBC mode is used, but the algorithm is secret. You also have some encrypted data (chosen plain text), ...
7
votes
3answers
212 views

Generating random non-repeating numbers from a small group

I read this Q&A which gave a clever solution: feed an incrementing index into a block key cipher as a way of producing non-repeating random numbers. The problem is the block size of all the good ...
1
vote
1answer
77 views

How to use AES-CBC to password-encrypt a small block of stored data

I have a small block of data (16 bytes) that I am required to encrypt, store (in an unsecure, visible location). Later I have to retrieve and decrypt it. I must use AES-CBC and a user-entered ...
3
votes
1answer
84 views

Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
1
vote
2answers
102 views

Block cipher block and key sizes

Is there any point in making block size less than key size in block cipher? For example, Russian GOST symmetric cipher uses 256-bit keys to encrypt 64-bit blocks. That means there are many keys which ...
3
votes
0answers
110 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
1
vote
1answer
82 views

How would an attacker perform an exhaustive key search on a block cipher using ECB mode?

Do you always assume from Kerchoff's principle, that the attacker has access to everything but the decryption key? That is, am I to assume that to perform an exhaustive key search, the attacker has a ...
3
votes
2answers
83 views

A block cipher whose key changes after each block

I have been reading about various block cipher modes of operation, and all of them seem to treat the block cipher (including it's key and key schedule) as a sort of immutable black box. I would like ...
4
votes
2answers
186 views

How secure would hand ciphers be using a Block Cipher Mode?

I've been looking into different ciphers that require very minimal computation power (calculator, deck of cards, index cards and a pencil), i.e. hand ciphers. For the most part all methods typically ...
1
vote
1answer
32 views

Is there an avalanche effect using block cipher modes of operation?

I am studying cryptography and various block cipher modes of operation. Suppose I changed one bit in the last block of the message. Wouldn't that imply no change in all encrypted blocks except for ...
4
votes
2answers
187 views

Should I use a self-designed Block Cipher Mode of Operation?

We all know we should NOT roll our self-designed encryption algorithm, how about block cipher mode with a certificated cipher method like AES? Will a self-designed block cipher mode cause any flaws or ...
3
votes
0answers
33 views

Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
2
votes
3answers
210 views

What is the difference between substitution cipher and block cipher?

I'm studying(and clearing my head) about block cipher. I started from Caesar Cipher which can be considered as a kind of substitution cipher (if my understanding is right). And an ideal substitution ...
4
votes
2answers
122 views

Using One Time Pad with a block cypher

The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ...
0
votes
0answers
19 views

Problem with braking SASAS type of encryptions

I am reading the paper Structural cryptanalysis of SASAS. I understood it till the section Recovering of layers S1 and S3 on page 6. However because of my limited understanding of mathematics, I am ...
1
vote
0answers
50 views

Is it possible to create a detection oracle for all block cipher modes? — ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
0
votes
0answers
48 views

Rijndael variant using AES for key schedule? [on hold]

The weakest part of Rijndael is considered to be the key schedule (I believe that this is true for all variants, including ones not standardized as AES). One solution to this problem is to use (...
1
vote
2answers
50 views

Tell where messages begin and end in a series of ciphertext blocks?

With block ciphers, I understand that the plaintext is first broken down into the right-sized blocks, padded, and then encrypted into the same number of cipher blocks. Once these blocks are sent over ...
0
votes
0answers
41 views

Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
1
vote
0answers
33 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
17
votes
3answers
2k views

How to publish a cipher (concept)?

In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way. So ...
3
votes
2answers
239 views

Constant time multiplicative inverse within a word

I was playing with an algorithm which at one step, calculated $f(x) = x^{-1} \mod p$ for $0 < x < p = 2^{64}-59$ (note $p$ is a prime). I used Knuth's Vol 2 Algorithm X algorithm for calculating ...
1
vote
1answer
41 views

What information about the ciphertext can an attacker discern if a key is used too many times?

Suppose that I use Blowfish or XTEA (both secure block ciphers with 64-bit block size) in CTR mode. In these cases, I need to change the key after $2^{16}$ blocks to avoid leaking information with ...
1
vote
0answers
31 views

Does extra encryption improve the security of CBC and CTR?

I am learning about cryptography and during my research and reading I had a question. When looking at information leakage and CBC mode, I asked if there is a way to improve this with by using the ...
1
vote
1answer
154 views

Doubling the block length of a given block cipher

IMHO the main essence of a Feistel cipher of block length $n$ is the working of a non-linear function $F$ that is applied to the two halves of the block of length $n/2$. Now suppose a certain block ...
3
votes
2answers
127 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
0
votes
0answers
43 views

Why does Rabin cryptosystem split the message into key blocks?

Why does Rabin cryptosystem split the message into key blocks and not into plain text blocks like in Merkle Damgard Construction? Is it because it acts in a way similar to IV? Probably not, it doesn'...
1
vote
0answers
36 views

Why was AES limited by NIST to a 128-bit block size, although Rijndael could support more? [duplicate]

Rijndael could support block sizes up to 256 bits; this seems to be useful in AEAD. Wht did NIST restrict AES to a 128-bit block size?
1
vote
0answers
44 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
3
votes
1answer
64 views

Block cipher mode of operation with beyond-birthday-bound security

I am looking for block cipher modes of operation that are secure even when the number of blocks encrypted exceeds the birthday bound.