A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

1
vote
2answers
213 views

Is there a theoretical maximum useful keysize given the block-size?

Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then: ...
1
vote
1answer
140 views

Security of (cryptographic) padding compared to other methods for blockcompletion for block ciphers

As said in the heading, I want to know how the security of different padding methods, e.g. ANSI X.923, ISO 10126 and PKCS7, is compared to other methods to reach the needed block size, like ciphertext ...
5
votes
2answers
409 views

Camellia or AES - which should I use?

Imagine I am a software developer. I want a block cipher, and I have the choice of using AES or Camellia. Which should I use? Which makes more sense from a technical perspective, and why? I need ...
1
vote
2answers
357 views

Using IV buffer after altered inside a Rijndael CBC Encryption/Decryption process as IV for next message?

When sending a block to be decrypted or encrypted, with RijndaelCBC, we input the data to decrypt/encrypt and an IV for syncing and to prevent identical outputs for identical inputs. This question is ...
1
vote
1answer
157 views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
6
votes
2answers
534 views

Strength of CBC with Ciphertext Stealing

Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7? I would imagine the most common situation where CTS is necessary would be due to some size constraint of ...
2
votes
1answer
4k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
5
votes
1answer
450 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
3
votes
1answer
618 views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...
3
votes
1answer
102 views

How difficult is it to find the “pre-image” of a block cipher?

Say that I have $$ C_1 = AES_{k_1}(M_1) $$ How difficult would it be to find a key, K2 and plaintext M2 $$ C_2 = AES_{k_2}(M_2) $$ such that $$ C_1 == C_2 $$ How would using a block cipher ...
4
votes
2answers
221 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
4
votes
2answers
167 views

Why is it said that if we have a duplicate ciphertext block it can leak our information?

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring ...
2
votes
2answers
116 views

What prevents continued hashing of a key from being used as a cipher when xored with plaintext? [duplicate]

This is just an idea I had while looking through some threads so take it as you will. Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention ...
4
votes
6answers
389 views

A block cipher with independent keys for each round

I want to modify a standard block cipher in the following way. I replace each round key by a key picked at random. Is this block cipher as secure as the original one ? Thank you. EDIT Some missing ...
16
votes
1answer
8k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
6
votes
1answer
435 views

What does NSA mean by 'Analyzable'?

Recently NSA published two new algorithms, Simon and Speck. In the abstract they say The aim of SIMON and SPECK is to fill the need for secure, flexible, and analyzable lightweight block ciphers. ...
2
votes
1answer
311 views

Block cipher with key longer than block size

When a block cipher key length is greater than the block length, is it the case that for some keys $k_0, k_1$ (with $k_0 \not= k_1$) and plaintext message $m$ that $E_{k_0}(m) = E_{k_1}(m)$?
8
votes
2answers
579 views

Is a small size block cipher usable?

Consider a block cipher with a key of size 128 bits but a small block size, say 32 bits. Is this kind of block cipher secure? I would like to know to what extent I can use a small block cipher, like ...
3
votes
2answers
190 views

Have these compositions of block ciphers the same security?

I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$. Are these 3 compositions equivalent in terms of security? ...
3
votes
3answers
258 views

Block cipher fixed points

A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing: $\theta: S\to S$. In this there ...
2
votes
2answers
199 views

Composition of block ciphers and 3DES

There is some intriguing things about DES and 3DES. Now, I know that DES is weak and 3DES was an attempt to construct a more secure block-cipher from a deprecated one. Having this in mind, what ...
3
votes
2answers
354 views

Are block ciphers used in public key crypto?

I was reading about block ciphers and most articles state they are being used in symmetric key cryptography. Are they also being used in public key cryptography? if not, what alternative pkc use? ...
2
votes
2answers
303 views

Secure use-cases of block cipher with 64-bit block size

In what cases can we use a weak block cipher like DES ? More precisely, Are there specific situation in which a weaken block cipher can still be used, for instance for certain types of plaintext ?
2
votes
0answers
109 views

How well analyzed are giant block length ciphers?

I have heard about ciphers that have a block length of 256 megabytes... That is huge. How well are they understood by the encryption community? I'm referring to PMC Ciphers. Has anyone used such a ...
5
votes
2answers
1k views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
1
vote
1answer
844 views

AES AddRoundKey

Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
3
votes
1answer
550 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
2
votes
2answers
263 views

Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like DaviesĀ­-Meyer or Miyaguchi-Preneel are ...
0
votes
1answer
414 views

Ciphertext-only attack on Simplified DES

Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
1
vote
2answers
143 views

Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?

If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
242 views

Is there a preferred way/standard on how to transmit an initialization vector for AES encryption

Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
7
votes
1answer
1k views

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$). That explains why we are using 256 bit ...
1
vote
1answer
165 views

Is there an efficient way to hide the encrypted plaintext length with a block cipher?

In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $NĀ·16$ bytes) the size of the ...
2
votes
1answer
272 views

What is the usual block cipher mode that goes with CTS

I am wondering: what is the most common, or most used, block cipher mode used that goes with CTS (CypherText Stealing)? Is it ebc or cbc?
0
votes
1answer
202 views

How to secure a mental poker protocol? [closed]

I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
5
votes
2answers
385 views

Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...
4
votes
1answer
340 views

Security of Pohlig-Hellman exponentation cipher?

I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
9
votes
1answer
2k views

Why is CAMELLIA suddenly so widely used?

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ...
8
votes
7answers
578 views

Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
1
vote
1answer
775 views

AES key/ciphertext space sizes

This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
5
votes
1answer
223 views

Low complexity implementation of a small blocksize cipher (< 64 bit)

Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE. This one in particular suggests using AES as the round function of a Feistel network. The ...
2
votes
1answer
527 views

Can we replace the XOR operation in DES with some other operation?

Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
2
votes
1answer
323 views

What are rounds in the context of ciphers?

Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
2
votes
1answer
103 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
4
votes
3answers
224 views

What is a block cipher?

I have read about block ciphers, but I do not understand the topic completely. Is a block cipher a way to send data or a way to encrypt data? How is the data divided into multiply blocks before it ...
9
votes
1answer
3k views

Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
4
votes
2answers
272 views

Is it possible to break a hash-based block cipher?

Let's define the following block cipher: $C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
2
votes
1answer
320 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
0
votes
2answers
332 views

Properties of Ideal Straight P-Boxes

What properties should an ideal straight P-Box exhibit?
4
votes
1answer
209 views

Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...