A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

-1
votes
1answer
468 views

File Encryption/Decryption in ECB mode [duplicate]

Possible Duplicate: Removing Padded Value in Decrypted Message I tried to encrypt and decrypt a file in ECB mode using AES Algorithm but I encountered one problem during decryption, I don't ...
1
vote
2answers
125 views

How can I protect against the failure of a block or symmetric cipher?

Can I protect against the failure of a block or symmetric cipher by chaining different techniques together? If so what implementation details should I be aware of? Are some combination of ciphers ...
2
votes
1answer
3k views

In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step? Is it the 10th round key? For example, is this the right order? ...
4
votes
1answer
530 views

How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
6
votes
3answers
3k views

Encryption with “constant” initialization vector considered harmful

I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice. For stream ciphers not doing ...
7
votes
3answers
3k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the ...
7
votes
2answers
717 views

Does AES have any fixed-points?

Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M? If yes, how do I go about (efficiently) finding such a pair?
8
votes
3answers
1k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
8
votes
1answer
615 views

XSL on serpent and rijndael - which is most affected?

So I've often looked at serpent and thought it was a very strong contender in AES. Not so long ago I was looking for evidence as to why it didn't beat rijndael. So far, the closest I've got answering ...
7
votes
2answers
3k views

How to calculate an IV when I have a shared private key?

I'm working with a server/client system that has securely negotiated a private key. I need to encrypt/decrypt messages passing in both directions which are typically between 100 bytes to 100 KB. I'm ...
2
votes
1answer
124 views

McEliece for streaming data

Under the assumption that there exists a real-world implementation of the McEliece scheme, could it be applied to streaming data as is? By that I mean in 'block cipher mode'? I've read that McEliece ...
6
votes
2answers
6k views

Rijndael vs. Serpent vs. Twofish: General comparison

Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision? Or is there ...
4
votes
3answers
1k views

A simple block cipher based on the SHA-256 hash function [duplicate]

I've come up with this little routine for doing encryption using the SHA-2 (in this case SHA-256) hash function. As such it is a block cipher with a 256 bit (32 byte) block size and an arbitrary key ...
4
votes
1answer
1k views

Known Plaintext attack against XTEA?

I'm looking for information on known-plaintext attacks against XTEA. I'm most interested in the worst case scenario: if an attacker has all 8 bytes of input and all 8 bytes of output, how much ...
3
votes
1answer
273 views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unkown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that ? Is there a ...
2
votes
1answer
163 views

Does an attacker gain an advantage if they have the initialisation vector?

Does an attacker gain any advantage by knowing which initialisation vector was used for encryption?
4
votes
2answers
352 views

Does this block cipher mode allow for decryption?

Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown? $$ P_0 = IV $$ $$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$
12
votes
1answer
7k views

How to choose a padding mode with AES

Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None. I ...
4
votes
2answers
360 views

Is it safe to store initial counter value for AES-CTR alongside with ciphertext?

The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
8
votes
1answer
967 views

AES and perfect ciphers

I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ...
10
votes
3answers
500 views

Are these emerging threats against AES affecting your designs?

Recentally, an attack on AES was discovered which reduces its computationally complexity, by a very slight amount. The first key recovery attack on the full AES-128 with computational complexity ...
7
votes
3answers
6k views

Is Blowfish strong enough for VPN encryption?

I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths. ...
4
votes
2answers
3k views

Encrypted text length in AES

I have created an application that will be able to read any file and encrypt it using AES Encryption. For efficiency, I am reading a block of data, encrypting it and so on. So for decrypting, I just ...
13
votes
2answers
9k views

AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
4
votes
1answer
187 views

Does anyone have a KAT for 3DES KO-2?

Does any one have, or can refer to a Known-Answer-Test (KAT) for Triple DES Keying Option 2? (Keying Option 2 means $C = DES_{k_1}(DES^{-1}_{k_2}(DES_{k_1}(P)))$ for encryption and $P = ...
13
votes
1answer
1k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
7
votes
3answers
835 views

Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
22
votes
2answers
2k views

How do I apply differential cryptanalysis to a block cipher?

I've read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are, for example, vulnerable to differential cryptanalysis. I ...
4
votes
1answer
172 views

Is a changing public truecrypt container secure?

I have a Truecrypt container which I want to synchronise between computers (i.e. different people, that I want to share the data with). If I used Dropbox for synchronisation and someone downloaded ...
3
votes
1answer
656 views

KeeLoq showing that decryption is indeed the inverse of encryption

In some text I am reading, there is an exercise asking to show that KeeLoq decryption function is the inverse of the encryption function. Details about KeeLoq are given in the Wikipedia article. As I ...
9
votes
1answer
912 views

Replacing the Rijndael S-Box?

The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?