# Tagged Questions

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

108 views

### OMAC : Padding on empty string

I started to implement some MAC since last week with the specifications given here. I'm currently testing the OMAC (one-key CBC) with test vectors. In the OMAC specifications at page 4, they explain ...
288 views

### Generalizing a CBC-MAC collision with a common final message block

I found this question from a textbook but I don't really understand what it is asking: Suppose $c$ is $1$ block long, $a$ and $b$ are strings that are a multiple of the block length, and ...
83 views

### Known Plaintext Attack against 3-round SPECK48/96

I am attempting to break 3-round SPECK48/96 using a known-plaintext attack, provided with 10 PT-CT pairs. Here is a diagram: I have seemed to almost figure this out, but I cannot figure out how the ...
206 views

### Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
668 views

### Analyzing ECB's and CBC's resistence to a known-plaintext attack

I'm trying to analyze the strength of a block cipher with CBC mode or with ECB mode on the scenario of an exhaustive search attack with knowledge of pairs of plaintext – ciphertext (known plaintext ...
97 views

### How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
28 views

### Breaking linear blockcipher - expanding recursive formula

I am trying to break a block cipher that can be defined as follows: We have 12 rounds and at each round we perform the following operation. We split 64 bit data into 2 parts each 32-bits, $\ x_r$ ...
296 views

### What is the fastest block cipher in the (Intel) world?

In AES competition,Rijndael cipher obtained first rank and become Standard and Serpent, Twofish, RC6 and MARS obtained another ranks and I know that Serpent took second rank because it was slower than ...
464 views

### Is the 1st Encrypted Block Less Secure Than Subsequent Ones?

It's my understanding that Electronic Code Book (ECB) produces similar cypher text for similar plaintext inputs which is not a good thing. To get around that, Cypher Block Chaining (CBC) can be used ...
253 views

### Is it safe to encrypt random data using ECB mode?

If I have 48 random bytes, is it safe to encrypt them using ECB mode? Or is there still a good reason to use another mode like CTR, CBC, etc.? Context is this: I am creating something like a TLS ...
406 views

### What cipher mode is suitable for independantly decryptable short messages?

I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
2k views

### Is my pseudo-random initialization vector secure?

How can I know if I am generating a secure pseudorandom initialization vector? Currently I am planning to generate a pseudo-random initialization Vector using current date and time - is this secure ...
277 views

### Known plaintext, unknown 128 bit block cipher

I have an encrypted configuration file from an embedded device which I'm trying to decrypt. The file seems to be encrypted in 128bit blocks, as changing a single option causes a 16 byte block to ...
240 views

### I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?

In the Wikipedia article on Block Ciphers, it says about the Electronic Code Block mode: The disadvantage of this method is that identical plaintext blocks are encrypted into identical ...
731 views

### Secure use-cases of block cipher with 64-bit block size

In what cases can we use a weak block cipher like DES ? More precisely, Are there specific situation in which a weaken block cipher can still be used, for instance for certain types of plaintext ?
481 views

### salsa20 is invertible, useless in CTR mode?

I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is. If I use ...
136 views

### How is this affine function a pair wise independent permutation?

Can anybody explain how the below is true ? $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$. (..) Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$, ...
170 views

### implication of tweak on bruteforcing a block cipher

Consider a KPA attack, where the attacker gets known plain text and the corresponding cipher text. Since the encryption algorithm is known, he can brute force all possibilities of key bits. What is ...
457 views

### Two-dimensional S-Box

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key. If S-box is standard then this ...
179 views

### Does an attacker gain an advantage if they have the initialisation vector?

Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
280 views

### XTEA: patterns in plain text

I'm using XTEA to encrypt passwords that I store in a database. (I need to be able to decrypt these passwords later to log in on another system.) But now I have noticed something: if I decrypt a ...
370 views

### Why can the last block contain a full block of padding in CBC Encryption?

I'm trying to understand the SSL Poodle Attack and I'm wondering why the last block of a CBC Record can be full of padding? Wouldn't that mean that the useful data was already a multiple of the key ...
483 views

### SHACAL in SHA-256

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgard construction. And then the text said that the compression function used is based on the Davis-Meyer ...
572 views

### OFB or CTR mode without an IV

I'm reading the SSL specs here. The interesting thing seems to be that RC4 is not re-keyed with a new IV for each message. The stream cipher state is simply carried over to the next record. Why is ...
351 views

### Why does .NET's ECB mode implementation append a constant block to my ciphertext?

Consider the following code and output: ...
207 views

### Has there been any cryptanalysis of AES under a non-uniformly distributed key?

The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from ...
1k views

### How can AES be considered secure when encrypting large files?

Why is AES considered to be secure when encrypting large files since the algorithm is a block cipher? I mean, if the file is larger than the block size, the file will be broken down to fit the ...
463 views

### Interleaving bytes to make an effectively larger block size

Will applying a 16 byte bit block cipher such as AES over a 256 byte block to in the following way result in a much stronger cipher:- Apply block cipher with first key digest to each 16 byte group. ...
451 views

### Why is $h(H, m) = E(m, H) \oplus m$ insecure?

I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies­-Meyer or Miyaguchi-Preneel are ...
250 views

### Why are there no MACs inspired by block cipher modes other than CBC and CFB?

I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter. Why are CBC ...
206 views

### What is the use of segments in Cipher Feedback Mode (CFB)

In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
114 views

### How to only encrypt a subset of the plaintext

I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext. I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a ...
706 views

### Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
498 views

### what are the uses of tweaks in block ciphers?

Few block cipher modes has additional parameter , tweaks , especially the ones that are format preserving . Now the comments section of this blog entry says such tweaks can be used for BIN numbers, ...
695 views

### How does one use AES block cipher modes of operation?

This is the sequel to my previous question about AES block cipher modes of operation. (See: AES block cipher modes of operation) Now, here is my real problem. I have to use a block cipher with 8 bit ...
137 views

### What prevents continued hashing of a key from being used as a cipher when xored with plaintext? [duplicate]

This is just an idea I had while looking through some threads so take it as you will. Given a plaintext of any length and a key that a specific hash function is capable of taking as input(I mention ...
1k views

### What are rounds in the context of ciphers?

Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
406 views

### Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
396 views

### What is an oracle adversary?

I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
179 views

### How could block encryption in counter mode be secure from viewpoint of entropy?

A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
43 views

### Is the IV value in Davies Meyer construction public?

I am learning the construction of Davies-Meyer to construct a hash function from block ciphers. The definition that I found is $$H_i=E_{m_i}(H_{i-1})\oplus H_{i-1}.$$ where $E_k$ is a block cipher ...
268 views

### Is the GOST block cipher broken?

Is the GOST cipher broken or known to be weak and insecure? Please try to simplify your answer since I am a programmer and not a cryptographer and please consider this web page and tell me if the ...
100 views

### Can CFB mode of block cipher be used as a commutative encryption?

Can CFB mode of block cipher be used as a commutative encryption? Is it possible to use CFB mode of AES block cipher to create commutative encryption? With CTR it is possible but not secure.
318 views

### How are subkeys, in Feistel block ciphers, derived for each round?

I'm bit confused about the subkeys that are used in Feistel ciphers. I know that all the subkeys ki are derived from the main key K, but how? Say I have a simplified Feistel block cipher of i rounds, ...
83 views

### Distinguishing attack on stream cipher created from a block cipher in counter mode

A block cipher in counter mode creates a key stream by: $$z_i = E_K(IV || i)$$ Where $IV$ is some chosen initialisation vector (with some length $l$ less that $n$ bits) and $i$ is the binary ...
102 views

### Why are modes of operation used, what attacks do they prevent?

I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are Now I know if i do not use a mode of ...
218 views

### Can I simulate iterated AES-ECB with other block cipher modes?

I am trying to write some code using the Web Crypto API (http://www.w3.org/TR/WebCryptoAPI/#algorithm-overview) which provides only some of the block cipher modes for AES, intentionally excluding ...
480 views

### Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
244 views

### Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the ...
619 views

### Forge CBC-MAC given the MAC of two messages and of their concatenation

I found this question about CBC-MAC forging and want to make sure I understand it: Let a and be be two strings of block length one. Suppose the sender sends \$(a, \text{CBC-MAC}(a)), (b, ...