A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.
27
votes
4answers
6k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
24
votes
3answers
3k views
What are the benefits of the two permutation tables in DES?
Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
20
votes
2answers
974 views
How do I apply differential cryptanalysis to a block cipher?
I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis.
I ...
14
votes
2answers
1k views
How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?
I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world.
How can we reason about the symmetric ciphers cryptanalysis ...
13
votes
2answers
2k views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
11
votes
4answers
5k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
10
votes
3answers
725 views
Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?
Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
10
votes
2answers
1k views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
10
votes
3answers
559 views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
10
votes
1answer
3k views
How to choose a padding mode with AES
Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None.
I ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
9
votes
3answers
401 views
Are these emerging threats against AES affecting your designs?
Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount.
The first key recovery attack on the full AES-128 with computational
complexity ...
9
votes
2answers
1k views
Why use an Initialization Vector (IV)?
Why use an Initialization Vector (IV)?
How are IV's used?
What are the advantages/disadvantages of using an IV?
Why use an IV instead of a longer key in which some section of the key is pubic?
What ...
8
votes
1answer
426 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
7
votes
2answers
437 views
Does AES have any fixed-points?
Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M?
If yes, how do I go about (efficiently) finding such a pair?
7
votes
3answers
764 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
7
votes
2answers
2k views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
7
votes
1answer
458 views
Replacing the Rijndael S-Box?
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
6
votes
2answers
719 views
Why do block ciphers need a non-linear component (like an S-box)?
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?
How does it make the cipher more secure?
The only intuition I have ...
6
votes
3answers
205 views
Why is a MAC needed?
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.
The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
6
votes
1answer
470 views
Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)
Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
6
votes
2answers
323 views
Are Stream Ciphers Less Secure?
This is by no means a scientific observation, but it seems to me that stream ciphers receive a lot less attention than block ciphers. Is there any reason for this? (Is it because block ciphers are ...
6
votes
1answer
589 views
AES and perfect ciphers
I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES.
Obviously AES isn't a perfect cipher, since the ...
6
votes
1answer
280 views
Hash function from narrower block cipher operated in CBC-encryption mode?
I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
5
votes
5answers
347 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
5
votes
3answers
653 views
Security of simple xor and s-box cipher?
What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode?
A cipher's internal primitive might be a simple as this:
$C = S[M \oplus k]$, where ...
5
votes
2answers
686 views
How to calculate an IV when I have a shared private key?
I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
5
votes
2answers
2k views
Rijndael vs. Serpent vs. Twofish: General comparison
Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?
Or is there ...
5
votes
2answers
384 views
Where can i get the info to implement AES?
I know there are 100's of AES programs and websites out there but I can't seem to find a site that give me the detail I think I would/should need to write my own java program.
I was to write AES form ...
5
votes
3answers
445 views
Converting a stream cipher into a block cipher
The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
5
votes
2answers
133 views
Will varying plaintext compensate for a fixed initialisation vector?
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.
I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
5
votes
1answer
517 views
Why is CAMELLIA suddenly so widely used?
When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.
Is that not ...
5
votes
1answer
1k views
Avalanche effect in DES
I couldn't understand the avalanche effect in DES. Could someone explain how avalanche effect happens in DES
5
votes
1answer
294 views
XSL on serpent and rijndael - which is most affected?
So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
5
votes
1answer
118 views
Is there any general description language for block ciphers
In page 9 (16 in the PDF) of Final report of European project IST-1999-12324(NESSIE) it is mentioned that:
The NESSIE project is also developing a new generic tool to analyze block
ciphers with ...
4
votes
3answers
575 views
Is it feasible to build a stream cipher from a cryptographic hash function?
A few years ago I devised a symmetric-key system that worked like so:
...
4
votes
4answers
518 views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. ...
4
votes
3answers
406 views
CBC - a canonical mode, even though there are streaming modes
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
4
votes
2answers
213 views
Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
4
votes
3answers
802 views
Are there any simple and yet secure encryption algorithms?
Being very new to C++ and cryptography, I finally managed to implement a version of the Vinegere algorithm. I would like to try something a bit more complicated. I have looked at AES and DES and ...
4
votes
3answers
464 views
Encryption with “constant” initialization vector considered harmful
I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice.
For stream ciphers not doing ...
4
votes
3answers
149 views
What is a block cipher?
I have read about block ciphers, but I do not understand the topic completely.
Is a block cipher a way to send data or a way to encrypt data?
How is the data divided into multiply blocks before it ...
4
votes
2answers
164 views
Is it possible to break a hash-based block cipher?
Let's define the following block cipher:
$C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
4
votes
3answers
1k views
Is Blowfish strong enough for VPN encryption?
I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths.
...
4
votes
1answer
516 views
Known Plaintext attack against XTEA?
I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
4
votes
1answer
134 views
Does anyone have a KAT for 3DES KO-2?
Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2?
(Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = ...
4
votes
1answer
155 views
Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?
It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack.
This is an attack ...
4
votes
1answer
544 views
Padding methods for block ciphers - PKCS7 vs ANSI X.923
I was looking through block cipher padding methods, and found two good candidates:
ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
4
votes
1answer
146 views
Does Grover's algorithm effect block size or only key size?
We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security).
I heard somewhere ...
