A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

5
votes
2answers
890 views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
4
votes
1answer
395 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
4
votes
2answers
190 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
2
votes
1answer
579 views

Okay to use OpenSSL to encrypt then sign a message?

I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong. My current plan is ...
2
votes
1answer
97 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
3
votes
1answer
488 views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...
3
votes
1answer
101 views

How difficult is it to find the “pre-image” of a block cipher?

Say that I have $$ C_1 = AES_{k_1}(M_1) $$ How difficult would it be to find a key, K2 and plaintext M2 $$ C_2 = AES_{k_2}(M_2) $$ such that $$ C_1 == C_2 $$ How would using a block cipher ...
9
votes
1answer
381 views

Hash function from narrower block cipher operated in CBC-encryption mode?

I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
4
votes
2answers
151 views

Why is it said that if we have a duplicate ciphertext block it can leak our information?

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring ...
2
votes
2answers
110 views

What prevents continued hashing of a key from being used as a cipher when xored with plaintext? [duplicate]

This is just an idea I had while looking through some threads so take it as you will. Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention ...
6
votes
1answer
412 views

What does NSA mean by 'Analyzable'?

Recently NSA published two new algorithms, Simon and Speck. In the abstract they say The aim of SIMON and SPECK is to fill the need for secure, flexible, and analyzable lightweight block ciphers. ...
14
votes
2answers
3k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is pubic? What ...
3
votes
3answers
238 views

Block cipher fixed points

A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing: $\theta: S\to S$. In this there ...
3
votes
2answers
250 views

Are block ciphers used in public key crypto?

I was reading about block ciphers and most articles state they are being used in symmetric key cryptography. Are they also being used in public key cryptography? if not, what alternative pkc use? ...
2
votes
0answers
108 views

How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
1
vote
3answers
1k views

Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
4
votes
2answers
779 views

How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
1
vote
1answer
618 views

AES AddRoundKey

Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
2
votes
2answers
227 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
3
votes
1answer
395 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
0
votes
1answer
387 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
1
vote
2answers
132 views

Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?

If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
173 views

Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
6
votes
1answer
1k views

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
1
vote
1answer
159 views

Is there an efficient way to hide the encrypted plaintext length with a block cipher?

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
5
votes
4answers
859 views

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. ...
0
votes
1answer
159 views

How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
1
vote
1answer
598 views

AES key/ciphertext space sizes

This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
3
votes
1answer
181 views

Low complexity implementation of a small blocksize cipher (< 64 bit)

Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE. This one in particular suggests using AES as the round function of a Feistel network. The ...
2
votes
1answer
434 views

Can we replace the XOR operation in DES with some other operation?

Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
2
votes
1answer
199 views

What are rounds in the context of ciphers?

Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
4
votes
3answers
214 views

What is a block cipher?

I have read about block ciphers, but I do not understand the topic completely. Is a block cipher a way to send data or a way to encrypt data? How is the data divided into multiply blocks before it ...
8
votes
5answers
1k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
4
votes
2answers
246 views

Is it possible to break a hash-based block cipher?

Let's define the following block cipher: $C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
0
votes
2answers
307 views

Properties of Ideal Straight P-Boxes

What properties should an ideal straight P-Box exhibit?
4
votes
1answer
197 views

Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...
6
votes
2answers
1k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
2
votes
1answer
5k views

How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard

I have a question about RCON here is my illustration... this is the 128 bit key.. ...
2
votes
2answers
671 views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
2
votes
1answer
166 views

What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
1
vote
2answers
181 views

What cipher mode is suitable for independantly decryptable short messages?

I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
6
votes
2answers
189 views

Will varying plaintext compensate for a fixed initialisation vector?

This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest. I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
4
votes
3answers
8k views

Difference between stream cipher and block cipher

A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. A block cipher ...
1
vote
1answer
1k views

How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?

I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo. This is how IDEA operates: IDEA operates on ...
2
votes
1answer
166 views

How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
-2
votes
0answers
368 views

Why is there a strong distinction between stream and block ciphers? [duplicate]

If I don't err, in the literature a stream cipher is one in which each plaintext bit is processed individually, commonly via xor-ing with one bit of a random or pseudo-random bit stream, while a block ...
6
votes
3answers
985 views

Security of simple xor and s-box cipher?

What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode? A cipher's internal primitive might be a simple as this: $C = S[M \oplus k]$, where ...
2
votes
3answers
800 views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
2
votes
1answer
264 views

What are the safe ways to derive HMAC key using block cipher?

Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
1
vote
1answer
190 views

How is block cipher padding verified for consistancy?

Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding ...