A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms (1)

4
votes
2answers
122 views

Using One Time Pad with a block cypher

The One Time Pad is often described with a xor cipher. This is nice to show the theoretical strengths of the one time pad but not so great in real world scenarios where key reuse is a danger. So Is ...
2
votes
3answers
204 views

What is the difference between substitution cipher and block cipher?

I'm studying(and clearing my head) about block cipher. I started from Caesar Cipher which can be considered as a kind of substitution cipher (if my understanding is right). And an ideal substitution ...
0
votes
0answers
19 views

Problem with braking SASAS type of encryptions

I am reading the paper Structural cryptanalysis of SASAS. I understood it till the section Recovering of layers S1 and S3 on page 6. However because of my limited understanding of mathematics, I am ...
1
vote
0answers
50 views

Is it possible to create a detection oracle for all block cipher modes? — ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
1
vote
2answers
50 views

Tell where messages begin and end in a series of ciphertext blocks?

With block ciphers, I understand that the plaintext is first broken down into the right-sized blocks, padded, and then encrypted into the same number of cipher blocks. Once these blocks are sent over ...
1
vote
0answers
46 views

Rijndael variant using AES for key schedule?

The weakest part of Rijndael is considered to be the key schedule (I believe that this is true for all variants, including ones not standardized as AES). One solution to this problem is to use (...
0
votes
0answers
41 views

Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose: Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend ...
1
vote
0answers
33 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
3
votes
2answers
238 views

Constant time multiplicative inverse within a word

I was playing with an algorithm which at one step, calculated $f(x) = x^{-1} \mod p$ for $0 < x < p = 2^{64}-59$ (note $p$ is a prime). I used Knuth's Vol 2 Algorithm X algorithm for calculating ...
1
vote
1answer
41 views

What information about the ciphertext can an attacker discern if a key is used too many times?

Suppose that I use Blowfish or XTEA (both secure block ciphers with 64-bit block size) in CTR mode. In these cases, I need to change the key after $2^{16}$ blocks to avoid leaking information with ...
1
vote
0answers
31 views

Does extra encryption improve the security of CBC and CTR?

I am learning about cryptography and during my research and reading I had a question. When looking at information leakage and CBC mode, I asked if there is a way to improve this with by using the ...
5
votes
2answers
240 views

Adding tweak to a block cipher

I know there are XEX, XTS and other ways to add tweak to block cipher without modifying cipher itself. However they are quite slow and/or complex. If we assume we have a secure block cipher round ...
6
votes
4answers
3k views

Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
0
votes
0answers
43 views

Why does Rabin cryptosystem split the message into key blocks?

Why does Rabin cryptosystem split the message into key blocks and not into plain text blocks like in Merkle Damgard Construction? Is it because it acts in a way similar to IV? Probably not, it doesn'...
3
votes
2answers
127 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
1
vote
0answers
36 views

Why was AES limited by NIST to a 128-bit block size, although Rijndael could support more? [duplicate]

Rijndael could support block sizes up to 256 bits; this seems to be useful in AEAD. Wht did NIST restrict AES to a 128-bit block size?
1
vote
0answers
44 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
37
votes
1answer
38k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
2
votes
1answer
255 views

Given a linear block-cipher,how can an attacker decrypt any plaintext value encrypted,using 128 chosen ciphertexts

Given the linear block cipher $\operatorname{LinearCipher}(k, p) = c$ $$\operatorname{LinearCipher}(k, p_1 \oplus p_2) = \operatorname{LinearCipher}(k, p_1) \oplus \operatorname{LinearCipher}(k, p_2)$...
7
votes
1answer
268 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
1
vote
3answers
137 views

Security of a parallelizable block cipher mode

This is the scheme of a parallelizable block cipher mode of operation: $IV$ is the initialization vector. $BN$ is the zero-based index number of a block in a stream of data. $BT$ is the tweak that ...
0
votes
0answers
47 views

Have ciphertext and key but need to figure out encryption method

So I have a block cipher (I think) that I need to break. I have the ciphertext and the key, but not the method of encryption, and was wondering if anyone could help me figure that out? The key is a 9 ...
2
votes
1answer
123 views

Block cipher not resistant to collisions

If we have the following block cipher, $E(k,m)$, which is a permutation, why is $f_2 (x,y)$ not collision resistant? $$f_2(x, y) = E(x, x \oplus y)$$
0
votes
2answers
104 views

How to encrypt incomplete block with RSA as a block cipher?

I have a question about an RSA academic example. If we are using block-RSA with a block-size of 3 and we have this message: "android". It is broken into 'and', 'roi', 'd'. How to encrypt the last ...
0
votes
0answers
55 views

How do substution-permutation networks work? [duplicate]

I understand what is going on in higher level. But I don't understand what's really going on in page 3 and 4 of this slide. Specifically, How $S_0$ and $S_1$ is used? What goes in what goes out? ...
10
votes
2answers
5k views

Can you explain “weak keys” for DES?

A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$. I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
3
votes
1answer
82 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...,k_{2^{40}...
1
vote
0answers
43 views

Algebraic relationship between Original Key and Sub Key of DES

Does there exist any sorts of algebraic relationship between Original and Sub Key of DES? I understand that by solving K-Maps of 64-bit Input/48-bit Output, I can get 16 algebraic relationships ...
3
votes
1answer
49 views

What information should I send along with an AES ciphertext and is there any standard to do that?

While using some crypto implementations I got to see that many times a comment is added to the ciphertext. For example: ...
0
votes
1answer
74 views

Finding a secret cipher given the key and known plaintext?

Let $x,y,k$ be plain text, cipher text and key respectively. Also suppose $\operatorname{Enc}$ is the algorithm of encryption for block cipher with size $n$. So we have $$\operatorname{Enc}_k(x)=y$$ ...
0
votes
1answer
48 views

Block cipher detect padding behaviour

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ...
3
votes
1answer
521 views

Should AES.decrypt(ct, wrong_key) return blank or wrong result?

I am trying to use AES as cipher for an application I am building. I am using a JavaScript library (https://code.google.com/p/crypto-js/) to perform encryption and decryption with AES. When I ...
0
votes
0answers
107 views

splitting the plaintext and ciphertext into blocks

Say I was to use RSA with a given value of n. I choose to split the plaintext and ciphertext written in a 27 letter alphabet into blocks with k and m characters resp. How would I find the largest ...
1
vote
1answer
50 views

Is this a secure keyed hashing construction?

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the ...
-5
votes
4answers
13k views

Found a way to crack AES-128, what now?

Let us assume the following scenario: I have just found a way to crack AES-128 in a reasonable time (1-2 days). How do I publish and prove this? I remember reading about lots of people who cracked ...
3
votes
1answer
882 views

Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in $\lbrace 128, 160, 192, 224, 256\rbrace$ bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of $32$). ...
5
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
7
votes
3answers
2k views

Where can I get information on how to implement AES?

I want to write AES from scratch without using the built in libraries of java. I know there are hundreds of AES programs (and websites) out there but I can't seem to find a site that gives me the ...
4
votes
0answers
42 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
10
votes
2answers
3k views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
4
votes
0answers
51 views

What is the correct definition of the blowfish F-function?

The Blowfish cipher uses a so called F-function which uses S-Boxes (S[i], i=0,1,2,3) to ...
-1
votes
1answer
225 views

What is the difference between key size and block size (for AES)

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does ...
2
votes
1answer
50 views

Is the IV value in Davies Meyer construction public?

I am learning the construction of Davies-Meyer to construct a hash function from block ciphers. The definition that I found is $$H_i=E_{m_i}(H_{i-1})\oplus H_{i-1}.$$ where $E_k$ is a block cipher ...
7
votes
2answers
3k views

How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
3
votes
2answers
98 views

Is it safe to use cipher block sizing instead of padding?

I'm using this kind of technique instead of padding of cipher buffer (here goes pseudo-code): ...
46
votes
7answers
52k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better? Edit: This question was asked long back when I was ...
6
votes
2answers
240 views

AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
0
votes
1answer
139 views

Combining a block cipher with a (pseudo) OTP

One of the drawbacks of OTP is that it can require an inconveniently long key. Besides that, it doesn’t provide data authentication. Therefore, I have been working on an algorithm idea, which I hope ...
24
votes
2answers
2k views

How do I apply differential cryptanalysis to a block cipher?

I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
1
vote
1answer
57 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...