A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms (1)

0
votes
0answers
37 views

Have ciphertext and key but need to figure out encryption method

So I have a block cipher (I think) that I need to break. I have the ciphertext and the key, but not the method of encryption, and was wondering if anyone could help me figure that out? The key is a 9 ...
2
votes
1answer
113 views

Block cipher not resistant to collisions

If we have the following block cipher, $E(k,m)$, which is a permutation, why is $f_2 (x,y)$ not collision resistant? $$f_2(x, y) = E(x, x \oplus y)$$
0
votes
2answers
87 views

How to encrypt incomplete block with RSA as a block cipher?

I have a question about an RSA academic example. If we are using block-RSA with a block-size of 3 and we have this message: "android". It is broken into 'and', 'roi', 'd'. How to encrypt the last ...
0
votes
0answers
55 views

How do substution-permutation networks work? [duplicate]

I understand what is going on in higher level. But I don't understand what's really going on in page 3 and 4 of this slide. Specifically, How $S_0$ and $S_1$ is used? What goes in what goes out? ...
10
votes
2answers
5k views

Can you explain “weak keys” for DES?

A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$. I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
3
votes
1answer
75 views

Multi-target attacks on AES-CTR with a random nonce

128-bit block ciphers are vulnerable to multi-target attacks where the attacker seeks to attack a collection of keys instead of a single key. A simple example: Generate keys $k_1, k_2, ...
1
vote
0answers
41 views

Algebraic relationship between Original Key and Sub Key of DES

Does there exist any sorts of algebraic relationship between Original and Sub Key of DES? I understand that by solving K-Maps of 64-bit Input/48-bit Output, I can get 16 algebraic relationships ...
3
votes
1answer
47 views

What information should I send along with an AES ciphertext and is there any standard to do that?

While using some crypto implementations I got to see that many times a comment is added to the ciphertext. For example: ...
0
votes
1answer
65 views

Finding a secret cipher given the key and known plaintext?

Let $x,y,k$ be plain text, cipher text and key respectively. Also suppose $\operatorname{Enc}$ is the algorithm of encryption for block cipher with size $n$. So we have $$\operatorname{Enc}_k(x)=y$$ ...
0
votes
1answer
44 views

Block cipher detect padding behaviour

Suppose i have a crypto provider, i.e: i give that provider some plaintext bytes and get the encrypted result. I don't know the used encryption method, but i know ...
3
votes
1answer
444 views

Should AES.decrypt(ct, wrong_key) return blank or wrong result?

I am trying to use AES as cipher for an application I am building. I am using a JavaScript library (https://code.google.com/p/crypto-js/) to perform encryption and decryption with AES. When I ...
0
votes
0answers
91 views

splitting the plaintext and ciphertext into blocks

Say I was to use RSA with a given value of n. I choose to split the plaintext and ciphertext written in a 27 letter alphabet into blocks with k and m characters resp. How would I find the largest ...
1
vote
1answer
50 views

Is this a secure keyed hashing construction?

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the ...
-5
votes
4answers
12k views

Found a way to crack AES-128, what now?

Let us assume the following scenario: I have just found a way to crack AES-128 in a reasonable time (1-2 days). How do I publish and prove this? I remember reading about lots of people who cracked ...
3
votes
1answer
773 views

Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in $\lbrace 128, 160, 192, 224, 256\rbrace$ bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of $32$). ...
5
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
7
votes
3answers
2k views

Where can I get information on how to implement AES?

I want to write AES from scratch without using the built in libraries of java. I know there are hundreds of AES programs (and websites) out there but I can't seem to find a site that gives me the ...
4
votes
0answers
35 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
10
votes
2answers
3k views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
4
votes
0answers
50 views

What is the correct definition of the blowfish F-function?

The Blowfish cipher uses a so called F-function which uses S-Boxes (S[i], i=0,1,2,3) to ...
-1
votes
1answer
119 views

What is the difference between key size and block size (for AES)

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does ...
2
votes
1answer
43 views

Is the IV value in Davies Meyer construction public?

I am learning the construction of Davies-Meyer to construct a hash function from block ciphers. The definition that I found is $$H_i=E_{m_i}(H_{i-1})\oplus H_{i-1}.$$ where $E_k$ is a block cipher ...
7
votes
2answers
3k views

How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
3
votes
2answers
97 views

Is it safe to use cipher block sizing instead of padding?

I'm using this kind of technique instead of padding of cipher buffer (here goes pseudo-code): ...
42
votes
7answers
48k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better? Edit: This question was asked long back when I was ...
5
votes
2answers
121 views

AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
0
votes
1answer
121 views

Combining a block cipher with a (pseudo) OTP

One of the drawbacks of OTP is that it can require an inconveniently long key. Besides that, it doesn’t provide data authentication. Therefore, I have been working on an algorithm idea, which I hope ...
24
votes
2answers
2k views

How do I apply differential cryptanalysis to a block cipher?

I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential ...
1
vote
1answer
57 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
2
votes
0answers
40 views

Differential Cryptanalysis

How do I find the differential characteristics using techniques Shrinking ? How do I extract the key on Differential Cryptanalysis using the technique Shrinking in Blockcipher Algorithm? Shrinking ...
21
votes
5answers
14k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
7
votes
1answer
113 views

Muchomor cipher

I've been given a task to research and possibly implement so called 'Muchomor' cipher. Has anybody ever heard of this cipher? I've found only one article about it and it was in Russian. I'm quite ...
3
votes
1answer
77 views

How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
4
votes
1answer
148 views

What are the steps to decrypt a TLS 1.1 record?

My question is related to another question in Cryptography about TLS 1.1 and 1.2. I have read both RFC 2246 The TLS Protocol Version 1.0 and RFC 4346 The TLS Protocol Version 1.1. What I know is that ...
9
votes
1answer
861 views

Is TEA considered secure?

Wikipedia claims that the best attack on the surprisingly simple TEA block cipher, that isn't a related-key attack, has a time complexity of $2^{121.5}$. So despite how unsophisticated the cipher ...
1
vote
0answers
114 views

Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
5
votes
2answers
228 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...
8
votes
1answer
147 views

A self-decrypting block-cipher

If I have a block-cipher like for example AES, a plaintext $x$, we use different function to encrypt and decrypt : $\text{encrypt}(x) = y$ , $\text{decrypt}(y)=x$. Now, if we build a function with a ...
5
votes
1answer
414 views

Pseudo random generator vs block encryption, which is faster?

If one wishes to encrypt one can either use a pseudo random generator to generate a long sequence and then xor it with plaintext, similarly he can use the seed as key to encrypt the plaintext using ...
4
votes
1answer
171 views

Block Cipher Without Key Schedule?

I'm designing a cryptography assignment for a college security course, and one of the problems is to perform a simple meet-in-the-middle attack on a 2-round, 2-key cipher. Since we want this to be a ...
2
votes
0answers
105 views

Pseudorandom Functions with different input and output lengths

I am working on a problem found in my Cryptography textbook that goes as follows: Let F be a pseudorandom function such that for $k \in \{0,1\}^n$, function $F_k$ maps $l_{in}(n)$-inputs to ...
0
votes
1answer
49 views

XTS-AES key management

XTS-AES uses two keys $(k_1, k_2)$, which are obtained from a concatenated key $k$. Does this key $k$ remain same for the whole disk or changes per sector?
2
votes
1answer
240 views

I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?

In the Wikipedia article on Block Ciphers, it says about the Electronic Code Block mode: The disadvantage of this method is that identical plaintext blocks are encrypted into identical ...
2
votes
1answer
50 views

Symmetric-like cyphers with several steps

Are there any good symmetric-ish cyphers that involve three or more steps with independent key material for each step? Formally, there should be a function $K(s)$ that returns a tuple $(k_1,..,k_n)$ ...
7
votes
1answer
911 views

Why is it OK for secretbox to leak the message length?

Most block cipher implementations expect users to pad so that the message matches the cipher block size. I understand the purpose of the padding is to make the input match the cipher block size. It ...
3
votes
1answer
324 views

Deciphering “easy” ciphers without hints

I've been keen on IT Security for a long time now and I've learned a lot about networking & security. However trying a "decryption challenge" I'm lacking what I think is basic ...
4
votes
0answers
139 views

Statistical saturation attack on block ciphers

I was wondering if anyone around here could give me some explanation on this type of attacks. Pretty much the only thing that I could find is A Statistical Saturation Attack against the Block Cipher ...
37
votes
3answers
8k views

What are the benefits of the two permutation tables in DES?

Why do we use a permutation table in the first step of DES algorithm and one at the end of the algorithm?
1
vote
1answer
44 views

Is there a standard prefix random padding scheme?

Is there a standardized padding scheme which is prefix instead of postfix and that uses random bytes except for the first byte which would be the length of the padding?
7
votes
3answers
1k views

Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...