A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.
4
votes
1answer
127 views
How common are SEED certificates outside of Korea? When is support required?
I'm looking at the SEED algorithm and would like to know if this is still in common usage.
Can anyone tell me when I would need to implement this standard, either as a client or a server?
4
votes
3answers
279 views
Order of cascaded ciphers
Does the order of a block cipher cascade (e.g. in TrueCrypt) make a difference to the security provided, assuming independant keys?
For example:
...
4
votes
0answers
87 views
Pseudo preimage for a hash made from a cipher
Consider the Miyaguchi–Preneel construction:
$H_0 = E(0,m_0) \oplus m_0$ (0 here means a vector filled with zeros)
$H_1 = E(H_0,m_1) \oplus H_0 \oplus m_1$
where $E(K,M)$ is a block cipher (for ...
3
votes
3answers
595 views
A simple block cipher based on the SHA-256 hash function
I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
3
votes
2answers
228 views
Is ECB mode secure if plaintexts guaranteed to be unique?
I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few ...
3
votes
2answers
185 views
AES - plaintext is smaller 128 bit - how to expaned?
we are currently developing a little AES implementation in a crypto-course at university.
As far as I know, AES uses 128 bit blocklength, so all data that will be encrypted will get split up into ...
3
votes
3answers
821 views
How does the key schedule of Rijndael looks for keysizes other than 128 bit?
It said in Wikipedia that:
[....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
3
votes
4answers
279 views
Which block cipher modes of operation allow a predictable IV?
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
3
votes
2answers
535 views
Encrypted text length in AES
I have created an application that will be able to read any file and encrypt it using AES Encryption. For efficiency, I am reading a block of data, encrypting it and so on. So for decrypting, I just ...
3
votes
1answer
94 views
Low complexity implementation of a small blocksize cipher (< 64 bit)
Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE.
This one in particular suggests using AES as the round function of a Feistel network.
The ...
3
votes
1answer
171 views
OCB - brute force against unknown IV
I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown.
Why is that ?
Is there a ...
3
votes
1answer
120 views
Encrypt array of int for individual retrieval
I have limited exposure to cryptographic terminology, so please bear with me.
My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
3
votes
2answers
306 views
How were the number of rounds for different key sizes of AES selected?
The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
3
votes
1answer
142 views
Is a changing public truecrypt container secure?
I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with).
If I used Dropbox for synchronisation and someone downloaded ...
2
votes
1answer
1k views
How to solve MixColumns
I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this?
I found some topic in the internet about MixColumns, but I still have a lot of question to ...
2
votes
2answers
246 views
Can I build a secure tweakable block cipher from a normal one by adding key and tweak?
Let (E,D) be a secure block cipher.
Consider the following tweakable block cipher:
...
2
votes
1answer
148 views
Does an attacker gain an advantage if they have the initialisation vector?
Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
2
votes
1answer
2k views
How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard
I have a question about RCON
here is my illustration...
this is the 128 bit key..
...
2
votes
2answers
201 views
Does this block cipher mode allow for decryption?
Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown?
$$ P_0 = IV $$
$$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$
2
votes
3answers
288 views
Layered XOR Cipher
I am aware of the vulnerabilities of simple xor ciphers and recently I came across a block cipher that claims to solve those vulnerabilities.
The cipher goes as follows with both the block and key ...
2
votes
2answers
132 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
2
votes
1answer
102 views
What is an oracle adversary?
I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
2
votes
1answer
1k views
Difference between stream cipher and block cipher
A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time.
A block cipher ...
2
votes
1answer
180 views
What are the safe ways to derive HMAC key using block cipher?
Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
2
votes
2answers
105 views
Byte location of plaintext vs ciphertext when using a block cipher or stream cipher
I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in ...
2
votes
1answer
303 views
How were the AES key and block length subsets of Rijndael selected?
My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
2
votes
3answers
1k views
Which one of the Block Cipher modes is the best?
I have two questions regarding the Block Cipher Modes:
First: Which one of the modes is considered the best?
I know CBC has a problem of IV since the next block of the plain text is XORed with the ...
2
votes
1answer
330 views
KeeLoq showing that decryption is indeed the inverse of encryption
In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article.
As I ...
2
votes
1answer
212 views
Is AES-256 a post-quantum secure cipher or not?
We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$).
That explains why we are using 256 bit ...
2
votes
1answer
94 views
Security of Pohlig-Hellman exponentation cipher?
I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
2
votes
1answer
733 views
In which order are the round keys used during AES decryption?
In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step?
Is it the 10th round key?
For example, is this the right order?
...
2
votes
1answer
92 views
McEliece for streaming data
Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
2
votes
0answers
78 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
1
vote
4answers
400 views
Is my pseudo-random initialization vector secure?
How can I know if I am generating a secure pseudorandom initialization vector?
Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
1
vote
1answer
171 views
Can we replace the XOR operation in DES with some other operation?
Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
1
vote
3answers
324 views
Malleability attacks against encryption without authentication
Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block:
...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
1
vote
2answers
138 views
AES Key Length vs Block Length
This answer points out that certain key and block lengths were a requirement for the AES submissions:
The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
1
vote
2answers
108 views
What cipher mode is suitable for independantly decryptable short messages?
I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
1
vote
1answer
117 views
Why does .NET's ECB mode implementation append a constant block to my ciphertext?
Consider the following code and output:
...
1
vote
3answers
672 views
Does encrypting twice using the same block cipher produce a security weakness?
If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.
...
1
vote
1answer
61 views
What are rounds in the context of ciphers?
Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
1
vote
1answer
136 views
How could block encryption in counter mode be secure from viewpoint of entropy?
A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
1
vote
1answer
125 views
How is block cipher padding verified for consistancy?
Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding ...
1
vote
1answer
456 views
How can 3DES encryption use decryption in the middle step?
I have been reading about the 3DES algorithm and I cannot understand one part. In 3DES we do following operation: $$C=E[K_3,D[K_2,E[K_1,P]]].$$
Where $C$ is ciphertext, $P$ is plaintext, $E$ is DES ...
1
vote
2answers
84 views
How can I protect against the failure of a block or symmetric cipher?
Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of?
Are some combination of ciphers ...
1
vote
1answer
67 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
1
vote
1answer
127 views
AES key/ciphertext space sizes
This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
1
vote
1answer
295 views
How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?
I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo.
This is how IDEA operates:
IDEA operates on ...
1
vote
1answer
56 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
