A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
4
votes
5answers
315 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
4
votes
3answers
542 views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
10
votes
3answers
707 views
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?
Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
8
votes
1answer
397 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
10
votes
2answers
990 views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
10
votes
4answers
4k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
5
votes
3answers
433 views
Converting a stream cipher into a block cipher
The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
3
votes
2answers
301 views
How were the number of rounds for different key sizes of AES selected?
The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
3
votes
3answers
813 views
How does the key schedule of Rijndael looks for keysizes other than 128 bit?
It said in Wikipedia that:
[....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
2
votes
1answer
302 views
How were the AES key and block length subsets of Rijndael selected?
My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
2
votes
1answer
1k views
How to solve MixColumns
I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this?
I found some topic in the internet about MixColumns, but I still have a lot of question to ...
1
vote
1answer
66 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
0
votes
1answer
379 views
Removing Padded Value in Decrypted Message
How to remove padded value in Decrypted Message?
I am using AES Algorithm..
ex:
this is the decrypted message..
"abcdefghijklmn "
there is a 2 space in that decrypted message which is equivalent ...
24
votes
3answers
2k views
What are the benefits of the two permutation tables in DES?
Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
20
votes
2answers
953 views
How do I apply differential cryptanalysis to a block cipher?
I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis.
I ...
7
votes
3answers
756 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
5
votes
3answers
632 views
Security of simple xor and s-box cipher?
What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode?
A cipher's internal primitive might be a simple as this:
$C = S[M \oplus k]$, where ...
7
votes
1answer
449 views
Replacing the Rijndael S-Box?
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
4
votes
3answers
391 views
CBC - a canonical mode, even though there are streaming modes
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
12
votes
2answers
949 views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
10
votes
3answers
540 views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
6
votes
1answer
579 views
AES and perfect ciphers
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.
Obviously AES isn't a perfect cipher, since the ...
5
votes
1answer
117 views
Is there any general description language for block ciphers
In page 9 (16 in the PDF) of Final report of European project IST-1999-12324(NESSIE) it is mentioned that:
The NESSIE project is also developing a new generic tool to analyze block
ciphers with ...
3
votes
4answers
277 views
Which block cipher modes of operation allow a predictable IV?
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
3
votes
1answer
120 views
Encrypt array of int for individual retrieval
I have limited exposure to cryptographic terminology, so please bear with me.
My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
3
votes
3answers
582 views
A simple block cipher based on the SHA-256 hash function
I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
2
votes
2answers
131 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
2
votes
2answers
243 views
Can I build a secure tweakable block cipher from a normal one by adding key and tweak?
Let (E,D) be a secure block cipher.
Consider the following tweakable block cipher:
...
2
votes
1answer
2k views
How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard
I have a question about RCON
here is my illustration...
this is the 128 bit key..
...
1
vote
1answer
49 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
1
vote
2answers
131 views
AES Key Length vs Block Length
This answer points out that certain key and block lengths were a requirement for the AES submissions:
The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
1
vote
1answer
287 views
How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?
I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo.
This is how IDEA operates:
IDEA operates on ...
1
vote
4answers
394 views
Is my pseudo-random initialization vector secure?
How can I know if I am generating a secure pseudorandom initialization vector?
Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
