A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

4
votes
1answer
212 views

How common are SEED certificates outside of Korea? When is support required?

I'm looking at the SEED algorithm and would like to know if this is still in common usage. Can anyone tell me when I would need to implement this standard, either as a client or a server?
4
votes
1answer
124 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
4
votes
1answer
291 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
4
votes
2answers
101 views

Is it possible to construct a secure block cipher of size $2n$ given a secure block cipher of size $n$?

Given, say, the Blowfish block cipher, which is considered secure but only has a 64-bit block size, can we construct a secure block cipher of 128-bit block size? Say we run the key through two KDFs, ...
4
votes
1answer
147 views

Would a symmetric cipher with a keylength a big as the data length be information theoretically secure?

One-Time-Pad is information theoretically secure as long as the random number stream is evenly long or longer than the data stream it encrypts, for a "decyphered" message could have been any message ...
4
votes
1answer
215 views

Does Grover's algorithm effect block size or only key size?

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security). I heard somewhere ...
4
votes
1answer
307 views

How to solve cipher encrypted with Vigenère + Columnar Transposition?

Vigenère's weakness is Kasiski's test and index of coincidence. However, if you put columnar transposition on top of Vigenère, that weakness is gone. The text is now shuffled and you can't search for ...
4
votes
1answer
163 views

Is a changing public truecrypt container secure?

I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with). If I used Dropbox for synchronisation and someone downloaded ...
4
votes
0answers
127 views

Adding tweak to a block cipher

I know there are XEX, XTS and other ways to add tweak to block cipher without modifying cipher itself. However they are quite slow and/or complex. If we assume we have a secure block cipher round ...
4
votes
0answers
117 views

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Define a commutative block cipher with keyspace the finite set $K$, and message space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto ...
3
votes
3answers
288 views

Block cipher fixed points

A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing: $\theta: S\to S$. In this there ...
3
votes
3answers
190 views

Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
3
votes
1answer
103 views

How difficult is it to find the “pre-image” of a block cipher?

Say that I have $$ C_1 = AES_{k_1}(M_1) $$ How difficult would it be to find a key, K2 and plaintext M2 $$ C_2 = AES_{k_2}(M_2) $$ such that $$ C_1 == C_2 $$ How would using a block cipher ...
3
votes
2answers
224 views

Composition of block ciphers and 3DES

There is some intriguing things about DES and 3DES. Now, I know that DES is weak and 3DES was an attempt to construct a more secure block-cipher from a deprecated one. Having this in mind, what ...
3
votes
2answers
441 views

Are block ciphers used in public key crypto?

I was reading about block ciphers and most articles state they are being used in symmetric key cryptography. Are they also being used in public key cryptography? if not, what alternative pkc use? ...
3
votes
2answers
1k views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
3
votes
2answers
364 views

Can I build a secure tweakable block cipher from a normal one by adding key and tweak?

Let (E,D) be a secure block cipher. Consider the following tweakable block cipher: ...
3
votes
2answers
583 views

Keeping IV secret for AES CFB mode

I'm developing a security/encryption software and I'm using AES CFB (block size: 16 and key size: 32 bytes). I want to know, if I also keep IV (32 bytes) secret like the key itself (32 bytes), would ...
3
votes
3answers
2k views

Does encrypting twice using the same block cipher produce a security weakness?

If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system. ...
3
votes
2answers
195 views

Have these compositions of block ciphers the same security?

I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$. Are these 3 compositions equivalent in terms of security? ...
3
votes
2answers
99 views

Which block cipher mode(s) is most appropriate in these applications?

I have a few questions I'm stuck on for a cryptography course I'm doing, any help would be much appreciated. The first application is for decryption on a multicore processor. I assume any of ECB, ...
3
votes
2answers
80 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
3
votes
1answer
159 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
2answers
420 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
1answer
815 views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...
3
votes
1answer
735 views

Okay to use OpenSSL to encrypt then sign a message?

I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong. My current plan is ...
3
votes
1answer
252 views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that ? Is there a ...
3
votes
1answer
565 views

KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
3
votes
1answer
118 views

Is it possible to generate a secure permutation F over 32-bit integers even if F(0) … F(n) is public knowledge?

I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ...
3
votes
1answer
83 views

Galois field step in XEX mode

I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly: $X = E_K(I) \oplus \alpha^j$ $C = E_K(M \oplus X) \oplus X$ where: $M$ is the ...
3
votes
1answer
123 views

Pseudorandom permutations on domains of arbitrary (i.e. not a power of 2) size

The Feistel cipher algorithm produces a pseudorandom permutation with domain size equal to $2^{2m}$ (for some $m \in \mathbb{Z}^+$). That is, a one-to-one function $\pi$ of the set $\{0, 1, 2, \dots, ...
3
votes
1answer
129 views

XOR with constant key in CBC mode

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode. Now, I am assuming ...
3
votes
2answers
256 views

GCM encryption for 256-bit and 512-bit block ciphers

The Galois/Counter Mode of Operation (GCM) This paper describe using GCM mode with 128-bit and 64-bit block cipher. Can we use this mode for 256-bit and 512-bit block cipher?
3
votes
1answer
97 views

Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?

I'm working with documents encrypted in long term storage. When a client requests the document, the document should be delivered encrypted under a distinct key (distinct from the long term storage ...
3
votes
1answer
342 views

Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. ...
3
votes
2answers
384 views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
3
votes
1answer
650 views

Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?

The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
3
votes
1answer
170 views

Encrypt array of int for individual retrieval

I have limited exposure to cryptographic terminology, so please bear with me. My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
3
votes
1answer
129 views

Security Level Estimate when Cascading/Compositing Ciphers?

Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not ...
3
votes
1answer
88 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
3
votes
1answer
150 views

Stream vs Block cipher: Synchronising and the receiver

I am learning cryptography at school and I was wondering: How are the blocks/streams after decryption synchronized at the receiver to form one long meaningful message? Am I right by saying that ...
3
votes
1answer
150 views

Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
3
votes
1answer
131 views

Analyzing ECB's and CBC's resistence to a known-plaintext attack

I'm trying to analyze the strength of a block cipher with CBC mode or with ECB mode on the scenario of an exhaustive search attack with knowledge of pairs of plaintext – ciphertext (known plaintext ...
2
votes
3answers
1k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
2
votes
4answers
1k views

Is my pseudo-random initialization vector secure?

How can I know if I am generating a secure pseudorandom initialization vector? Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
2
votes
1answer
619 views

Can we replace the XOR operation in DES with some other operation?

Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
2
votes
2answers
367 views

Secure use-cases of block cipher with 64-bit block size

In what cases can we use a weak block cipher like DES ? More precisely, Are there specific situation in which a weaken block cipher can still be used, for instance for certain types of plaintext ?
2
votes
2answers
257 views

salsa20 is invertible, useless in CTR mode?

I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is. If I use ...
2
votes
2answers
96 views

How is this affine function a pair wise independent permutation?

Can anybody explain how the below is true ? $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$. (..) Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$, ...
2
votes
2answers
135 views

implication of tweak on bruteforcing a block cipher

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is ...