A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

2
votes
2answers
572 views

Difference in one time key and one time pad and many time key

These terms are confusing me. One time pad is when you use one key for one message. That is what One time key is. Secondly, what is the connection of many time key, can i use one time pad many ...
1
vote
3answers
342 views

Does the MixColumns step come before or after AddRoundKey in AES decryption?

I found these images depicting the AES decryption process: In the first image, the MixColumns step comes before the AddRoundKey step, while in the second image, the AddRoundKey will come before ...
1
vote
1answer
196 views

How do I calculate the maximum plain text length allowable for a certain cipher text length?

I am encrypting and storing sensitive values in the database. I have a set max length in the database, but in order to provide useful user feedback, I'd like to know the max input I should allow for a ...
4
votes
4answers
476 views

Which block cipher modes of operation allow a predictable IV?

Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique ...
2
votes
4answers
751 views

Is my pseudo-random initialization vector secure?

How can I know if I am generating a secure pseudorandom initialization vector? Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
2
votes
1answer
173 views
3
votes
1answer
156 views

Encrypt array of int for individual retrieval

I have limited exposure to cryptographic terminology, so please bear with me. My end goal is to encrypt integer IDs, before transmitting them to a web client in a list of search results, in a way ...
2
votes
2answers
320 views
6
votes
3answers
265 views

Why is a MAC needed?

I agree that for certain encryption systems or modes of operation, a MAC is indispensible. The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
12
votes
3answers
1k views

Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
4
votes
1answer
1k views

Padding methods for block ciphers - PKCS7 vs ANSI X.923

I was looking through block cipher padding methods, and found two good candidates: ANSI X.923 - pad with zeros, then a final byte for the padding length, e.g. ...
2
votes
2answers
149 views

Byte location of plaintext vs ciphertext when using a block cipher or stream cipher

I know that when you use a stream cipher you are just XOR'ing the plain text with the PRNG stream, such that you know if a specific byte is in position 3 of the plain text it will still be in ...
3
votes
2answers
365 views

Is ECB mode secure if plaintexts guaranteed to be unique?

I've got a scenario where I need to encrypt many small (16-byte) plaintexts. I want to use AES-128 in ECB mode. Notably, each plaintext is guaranteed to be unique, though each may differ by only a few ...
30
votes
3answers
4k views

What are the benefits of the two permutation tables in DES?

Why do we use a permutation table in the first step of DES algorithm and one at the end of algorithm?
5
votes
3answers
583 views

CBC - a canonical mode, even though there are streaming modes

Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
1
vote
1answer
773 views

How can 3DES encryption use decryption in the middle step?

I have been reading about the 3DES algorithm and I cannot understand one part. In 3DES we do following operation: $$C=E[K_3,D[K_2,E[K_1,P]]].$$ Where $C$ is ciphertext, $P$ is plaintext, $E$ is DES ...
-1
votes
1answer
322 views

File Encryption/Decryption in ECB mode [duplicate]

Possible Duplicate: Removing Padded Value in Decrypted Message I tried to encrypt and decrypt a file in ECB mode using AES Algorithm but I encountered one problem during decryption, I don't ...
1
vote
2answers
104 views

How can I protect against the failure of a block or symmetric cipher?

Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of? Are some combination of ciphers ...
2
votes
1answer
2k views

In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step? Is it the 10th round key? For example, is this the right order? ...
4
votes
1answer
419 views

How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
5
votes
3answers
1k views

Encryption with “constant” initialization vector considered harmful

I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice. For stream ciphers not doing ...
5
votes
3answers
2k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
7
votes
2answers
603 views

Does AES have any fixed-points?

Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M? If yes, how do I go about (efficiently) finding such a pair?
8
votes
3answers
899 views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
8
votes
1answer
479 views

XSL on serpent and rijndael - which is most affected?

So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
6
votes
2answers
1k views

How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
2
votes
1answer
104 views

McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
6
votes
2answers
4k views

Rijndael vs. Serpent vs. Twofish: General comparison

Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision? Or is there ...
4
votes
3answers
942 views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
4
votes
1answer
834 views

Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
3
votes
1answer
222 views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that ? Is there a ...
2
votes
1answer
155 views

Does an attacker gain an advantage if they have the initialisation vector?

Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
4
votes
2answers
247 views

Does this block cipher mode allow for decryption?

Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown? $$ P_0 = IV $$ $$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$
11
votes
1answer
5k views

How to choose a padding mode with AES

Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None. I ...
4
votes
2answers
267 views

Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
8
votes
1answer
779 views

AES and perfect ciphers

I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ...
10
votes
3answers
450 views

Are these emerging threats against AES affecting your designs?

Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount. The first key recovery attack on the full AES-128 with computational complexity ...
4
votes
3answers
3k views

Is Blowfish strong enough for VPN encryption?

I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths. ...
4
votes
2answers
1k views

Encrypted text length in AES

I have created an application that will be able to read any file and encrypt it using AES Encryption. For efficiency, I am reading a block of data, encrypting it and so on. So for decrypting, I just ...
10
votes
2answers
5k views

AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
4
votes
1answer
156 views

Does anyone have a KAT for 3DES KO-2?

Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2? (Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = ...
12
votes
1answer
694 views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
5
votes
2answers
537 views

Where can i get the info to implement AES?

I know there are 100's of AES programs and websites out there but I can't seem to find a site that give me the detail I think I would/should need to write my own java program. I was to write AES form ...
7
votes
3answers
608 views

Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
21
votes
2answers
1k views

How do I apply differential cryptanalysis to a block cipher?

I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis. I ...
3
votes
1answer
154 views

Is a changing public truecrypt container secure?

I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with). If I used Dropbox for synchronisation and someone downloaded ...
3
votes
1answer
487 views

KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
9
votes
1answer
655 views

Replacing the Rijndael S-Box?

The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?