A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

2
votes
2answers
548 views

Secure use-cases of block cipher with 64-bit block size

In what cases can we use a weak block cipher like DES ? More precisely, Are there specific situation in which a weaken block cipher can still be used, for instance for certain types of plaintext ?
3
votes
2answers
208 views

Have these compositions of block ciphers the same security?

I'm interested by the compositions of the block cipher DES, instantiated with independent keys $k_1$, $k_2$ and $k_3$. Are these 3 compositions equivalent in terms of security? ...
3
votes
1answer
162 views

Stream vs Block cipher: Synchronising and the receiver

I am learning cryptography at school and I was wondering: How are the blocks/streams after decryption synchronized at the receiver to form one long meaningful message? Am I right by saying that ...
1
vote
2answers
385 views

Why do these Python XTEA implementations require different deltas?

I once needed to an XTEA snippet to from C++ to Python and it did not work properly. I then found a function on ActiveState.com and noticed that it looks almost exactly like mine, with one exception - ...
1
vote
2answers
571 views

Using IV buffer after altered inside a Rijndael CBC Encryption/Decryption process as IV for next message?

When sending a block to be decrypted or encrypted, with RijndaelCBC, we input the data to decrypt/encrypt and an IV for syncing and to prevent identical outputs for identical inputs. This question is ...
1
vote
0answers
194 views

Pohlig-Hellman exponentiation block cipher

Let $G$ be a group of order $n$ and let $e,d$ be integers such that $ed\equiv 1 \pmod{n}$. Then the exponentiation maps $x \mapsto x^e$ and $y \mapsto y^d$ are inverse maps on $G$. These maps give us ...
6
votes
3answers
449 views

Slow one-way pseudo-random permutation?

I'm looking for a slow one-way pseudo-random permutation; or in other words a block cipher $E_K: P\in\{0,1\}^b\mapsto C\in\{0,1\}^b$ with moderate block size $b\approx 64$ bits, wide key $K$, ...
3
votes
1answer
114 views

Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?

I'm working with documents encrypted in long term storage. When a client requests the document, the document should be delivered encrypted under a distinct key (distinct from the long term storage ...
2
votes
1answer
189 views

Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the ...
4
votes
3answers
388 views

What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
14
votes
3answers
1k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
3
votes
1answer
101 views

OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
1
vote
1answer
105 views

How does the length of the plaintext affect the cipher strength?

Let the block length 64-bit, 256-bit key, cipher text accordingly - 64 bits. What is the strength of the block cipher, if any unknown attacks, which could reduce its strength. We can only brute force. ...
4
votes
2answers
338 views

What (precisely) is a block cipher?

If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher. Now I thought what would ...
2
votes
1answer
350 views

Why is it important to generate a pseudorandom permutation from a pseudorandom function?

Most of the papers on block cipher constructions, especially the ones which discuss constructing block ciphers of arbitrary lengths or small domains, the techniques are designed based on building a ...
16
votes
2answers
10k views

How long does it take to crack DES and AES?

Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second. How long would it take for to recover a DES key, ...
3
votes
1answer
490 views

Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. ...
4
votes
1answer
200 views

Why does CBC-MAC need prefix-free inputs to be a good PRF?

In the FFX spec, there is a note about using CMAC as the round function. Security notes. The round function F is constructed in such a way that the set of inputs on which the CBC-MAC is ...
8
votes
5answers
4k views

Are there any simple and yet secure encryption algorithms?

Being very new to C++ and cryptography, I finally managed to implement a version of the Vinegere algorithm. I would like to try something a bit more complicated. I have looked at AES and DES and ...
2
votes
3answers
338 views

OFB or CTR mode without an IV

I'm reading the SSL specs here. The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is ...
7
votes
1answer
180 views

Is there any general description language for block ciphers?

In page 9 (16 in the PDF) of Final report of European project IST-1999-12324 (NESSIE), it is mentioned that: The NESSIE project is also developing a new generic tool to analyze block ciphers ...
4
votes
1answer
230 views

How common are SEED certificates outside of Korea? When is support required?

I'm looking at the SEED algorithm and would like to know if this is still in common usage. Can anyone tell me when I would need to implement this standard, either as a client or a server?
24
votes
2answers
6k views

Why does nobody use (or break) the Camellia Cipher?

If Camellia is of equivalent security and speed to AES, concerns arise. First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does ...
10
votes
1answer
3k views

Why is CAMELLIA suddenly so widely used?

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ...
5
votes
2answers
620 views

Camellia or AES - which should I use? [closed]

Imagine I am a software developer. I want a block cipher, and I have the choice of using AES or Camellia. Which should I use? Which makes more sense from a technical perspective, and why? I need ...
7
votes
1answer
739 views

What's wrong with MARS?

Why did the MARS cipher receive such a high number of negative votes in the AES competition? As I understand only MARS and Serpent implement measures to counter future cryptoanalytic attacks, so it ...
1
vote
1answer
551 views

Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
9
votes
1answer
1k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
1
vote
2answers
4k views

How does GCM (Galois/Counter Mode) work? [closed]

Can somebody explain how this mode works? What view has cipher text and how does it help to authenticate input’s data?
0
votes
1answer
173 views

Is AES a linear hash?

So, having read a variety of documentations on AES encryption, I came to the unknowledgeable conclusion that the key schedule applied to the array of chunks, and not just the 14 cycles on a single ...
9
votes
4answers
2k views
2
votes
1answer
203 views

NP complete problems related to permutations of binary vectors or block ciphers

Recently, T.Gowers wrote a blog entry called "How not to prove that P is not equal to NP" about the Razborov/Rudich Natural Proofs paper. He has a construction where he talks about compositions of ...
2
votes
2answers
339 views

what are the uses of tweaks in block ciphers?

Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving . Now the comments section of this blog entry says such tweaks can be used for BIN numbers, ...
2
votes
1answer
489 views

How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
3
votes
2answers
498 views

AES block cipher modes of operation

have a project in which I have to implement an en/de-cryption structure using a standard AES block of 128-bits in VHDL and I think I'm a bit confused. So I'd like to ask some questions about AES and ...
3
votes
2answers
507 views

Making counter (CTR) mode robust against application state loss

Counter (CTR) mode, which is a block cipher mode of operation, has some desirable qualities (no padding, parallel encryption and decryption), but at the cost of failing badly when non-unique counter ...
12
votes
2answers
3k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
1
vote
0answers
254 views

How to perform benchmark of block/stream ciphers?

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
6
votes
1answer
370 views

Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?

It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack. This is an attack ...
4
votes
1answer
449 views

How to choose keys for a block cipher?

AES and DES are block ciphers. Mathematically, its the mapping from plaintext space to ciphertext space using the keys i.e. $\{{0,1}\}^k$ x $\{{0,1}\}^l \longrightarrow \{{0,1}\}^l$ I know that these ...
12
votes
3answers
2k views

What is the ideal cipher model?

What is the ideal cipher model? What assumptions does it make about a block cipher? How does it relate to assuming that my block cipher is a pseudo-random permutation (PRP)? When is the ideal ...
1
vote
2answers
233 views

Is there a theoretical maximum useful keysize given the block-size?

Consider a block-cipher $F$ with a $N$-bit block-size and a $M$-bit key-size. That is, if $k$ is a $M$-bit key, $p$ is a $N$-bit block of plain-text and $c$ is a $N$-bit block of cipher-text, then: ...
29
votes
5answers
5k views

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world. How can we reason about the symmetric ciphers cryptanalysis ...
1
vote
1answer
287 views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
3
votes
1answer
8k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
5
votes
2answers
2k views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
6
votes
1answer
652 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
4
votes
2answers
321 views

CTR mode nonce with aggressive key rotation policy

I'm writing a small encryption library which will be required to use the shortest possible amount of overhead for describing ciphertexts. I want to use CTR mode with a 6-byte random nonce. Normally ...
2
votes
1answer
117 views

Using UMAC with stream cypher

I understand that most stream ciphers, due to being applied with a simple XOR, are specially fragile against data tampering, and must be used with some MAC mechanism. So I am investigating the use of ...
3
votes
1answer
1k views

SIMON implementation, decryption issues

I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I ...