A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

learn more… | top users | synonyms

2
votes
1answer
37 views

Calculate the security of a cascade cipher

I’m reading “The Security of Multiple Encryption in the Ideal Cipher Model” and I’m having a hard time understanding something. How do I calculate the bounds of cascade cipher from the following ...
2
votes
2answers
209 views

salsa20 is invertible, useless in CTR mode?

I'm reading the salsa20 spec (sorry for the newbie question, i'm really a newbie here). Every paragraph ends with : "this operation is invertible", I suppose the whole salsa20 algorithm is. If I use ...
0
votes
0answers
23 views

Discrepancy between RSA implementations [migrated]

I'm not a crypto-guy so I know close-to-zero about these things. I must interoperate with a system using RSA cryptography. When using their keys, I'm running into the problem of getting different ...
2
votes
1answer
147 views

How can AES be considered secure when encrypting large files?

Why is AES considered to be secure when encrypting large files since the algorithm is a block cipher? I mean, if the file is larger than the block size, the file will be broken down to fit the ...
0
votes
1answer
84 views

How to prove Security of Onion Layers of encryption?

CryptDB has Onion layers of Encryption to provide wider functionality from weaker forms of encryption. How do we prove such things are indeed secure ? Intuitively It seems ok. Are there any parallels ...
3
votes
2answers
80 views

Which block cipher mode(s) is most appropriate in these applications?

I have a few questions I'm stuck on for a cryptography course I'm doing, any help would be much appreciated. The first application is for decryption on a multicore processor. I assume any of ECB, ...
0
votes
1answer
74 views

What does $\to$ mean in the following definition of a block cipher?

In the following picture $\kappa$ is the key length and $n$ is the block size. I understand that $\{0,1\}^\kappa$ means all possible combination of keys and $\{0,1\}^n$ means all possible combination ...
2
votes
1answer
47 views

Bit padding instead of PKCS#5 padding

Padding oracle attacks are a huge nuisance when using CBC mode encryption without authentication. Wouldn't all those padding oracle attacks be avoided if we'd just use bit padding instead? Or is does ...
3
votes
1answer
80 views

Is it possible to generate a secure permutation F over 32-bit integers even if F(0) … F(n) is public knowledge?

I'm currently interested in the problem of generating random-looking URLs from sequential database IDs, like how they do it in link shorteners. One way to do this is to encrypt the sequential database ...
1
vote
1answer
74 views

Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in {128, 160, 192, 224, 256} bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of 32). The rounds ...
3
votes
1answer
142 views

Repeatable crypto

Is there a safe way to do crypto that will always produce the same result for a given input? My use case is transferring deltas of huge files, to a backup server. The backup server has no knowledge ...
1
vote
0answers
146 views

practically verifying block ciphers strength [closed]

How do we verify practically the strength of a block ciphers? Most of the security analysis of block ciphers is usually around theoretical analysis and proofs in some random oracle model etc. For ...
3
votes
2answers
208 views

Composition of block ciphers and 3DES

There is some intriguing things about DES and 3DES. Now, I know that DES is weak and 3DES was an attempt to construct a more secure block-cipher from a deprecated one. Having this in mind, what ...
4
votes
1answer
341 views

What are the advantages of CBC over ECB?

From this question I understand that, for a block cipher, using CBC is better than ECB. It seems that if one only has part of the cipher text, then decryption is difficult because the decryption ...
-5
votes
4answers
273 views

Found a way to crack AES-128, what now?

I have just found a way to crack AES-128 in a reasonable time (1-2 days). How do I publish and prove this? I remember reading about lots of people who cracked DES and other ciphers but how did they ...
2
votes
1answer
66 views

Construct block cipher from a smaller one with mixing function

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The key component is the ...
4
votes
1answer
102 views

What's the consequence of having a short IV? Is one mode better in that case?

I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
32
votes
4answers
12k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
2
votes
1answer
73 views

Variants of AES? [closed]

Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
5
votes
2answers
406 views

Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...
5
votes
2answers
223 views

Is my id obfuscation algorithm secure?

I'm designing an id obfuscation system. My system includes: Embedded chips, each chip has a unique 32-bit address (id). Server Insecure low-bandwidth unstable one-way channels from the chips to the ...
5
votes
1answer
205 views

Attacking a hardware AES implementation if it leaks the intermediate round states

Let's say that we have a hardware AES implementation that, on request, will encrypt or decrypt a 16-byte block of data in ECB mode using a fixed key, but refuses to reveal its fixed key. In other ...
7
votes
2answers
601 views

Where can I get information on how to implement AES?

I want to write AES from scratch without using the built in libraries of java. I know there are hundreds of AES programs (and websites) out there but I can't seem to find a site that gives me the ...
3
votes
2answers
86 views

Block-cipher based vs Hash based MAC

When it comes to MAC algorithms one can have many choices. CBC-MAC, CMAC, PMAC etc are some MAC algorithms that rely on block ciphers (ex AES) to generate a MAC. On the other hand HMAC is very popular ...
2
votes
1answer
323 views

Interleaving bytes to make an effectively larger block size

Will applying a 16 byte bit block cipher such as AES over a 256 byte block to in the following way result in a much stronger cipher:- Apply block cipher with first key digest to each 16 byte group. ...
2
votes
1answer
155 views

SHACAL in SHA-256

I was reading about hash functions, namely SHA, and I read that it is made of the Merkle-Damgard construction. And then the text said that the compression function used is based on the Davis-Meyer ...
0
votes
3answers
216 views

AES256-CBC vs AES256-CTR in SSH [duplicate]

I used AES256-CBC to SSH to a remote server. Recently, it stopped working with the following message: ...
2
votes
1answer
102 views

How to only encrypt a subset of the plaintext

I was wondering if there is a smart way for a user to only encrypt a subset of a plaintext. I'll try to be more specific. Let's suppose the user U wants to use a special cipher such that given a ...
16
votes
1answer
9k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
1
vote
1answer
37 views

Process of dividing 168bit key into 56bit keys in TripleDES

I used TripleDES so many times but never thought about this. In TripleDES it requires 168bit ...
4
votes
1answer
71 views

Turning PRPs in PRGs with a counter

I am following the Coursera Cryptography I course and I have the following question, I am a bit perplexed by the statement, in week 2 lecture "What are block cyphers?" that a counter-mode PRF is a ...
6
votes
3answers
158 views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
2
votes
1answer
61 views

How to find which padding method is used in Block cipher(AES) encyption?

I have a cipher text which is encrypted using AES128 Algorithm. I want to know the following things to decrypt the cipher. IV (Initialization Vector) Padding Method Encryption Key How do I find ...
3
votes
1answer
73 views

Galois field step in XEX mode

I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly: $X = E_K(I) \oplus \alpha^j$ $C = E_K(M \oplus X) \oplus X$ where: $M$ is the ...
3
votes
3answers
173 views

Effective security of block cipher – equal the key size, or half the key size?

The Wikipedia “Key Size” article states: The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. … … … Most ...
2
votes
1answer
289 views

What is the usual block cipher mode that goes with CTS

I am wondering: what is the most common, or most used, block cipher mode used that goes with CTS (CypherText Stealing)? Is it ebc or cbc?
2
votes
2answers
91 views

How is this affine function a pair wise independent permutation?

Can anybody explain how the below is true ? $I_n$ denotes the set of all n-bit strings, ${\{0,1\}}^n$. (..) Let $A$ be a finite field then the permutation $f_{(a,b)}(x) = a \cdot x + b$, ...
3
votes
1answer
110 views

Pseudorandom permutations on domains of arbitrary (i.e. not a power of 2) size

The Feistel cipher algorithm produces a pseudorandom permutation with domain size equal to $2^{2m}$ (for some $m \in \mathbb{Z}^+$). That is, a one-to-one function $\pi$ of the set $\{0, 1, 2, \dots, ...
4
votes
1answer
116 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
-1
votes
1answer
63 views

Pseudo Random Generator with fixed Hamming Weight [closed]

I'm searching for way to generate secure pseudo random sequence with a fixed Hamming weight using a seed. I found below code but I need a seed to generate a sequence ... (and need know if is possible ...
2
votes
1answer
101 views

Message lengths with AES CTR mode?

Im working on my own AES implementation as a personal educational exercise (not for production use), and a book im using as a resource states: In the case of CTR, we are merely XORing the output ...
3
votes
2answers
76 views

How do I construct variable length input (VIL) in a block cipher mode?

I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
2
votes
1answer
323 views

Break double encryption

Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$. In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
1
vote
1answer
279 views

Can AES decrypt with a wrong key?

The title is asking the question in layman terms, but what I really mean to ask is this: Let $x \in \lbrace 0,1 \rbrace^{128}$ (an arbitrary input block) and let $K \in \lbrace 0, 1 \rbrace^{128}$ ...
3
votes
1answer
111 views

XOR with constant key in CBC mode

I have a hypothetical encryption scheme where somebody uses the one-time pad in CBC mode. That is, the block cipher is $E(k, m) :=k⊕m$, and that block cipher is used in CBC mode. Now, I am assuming ...
2
votes
1answer
83 views

Chosen Ciphertext Attack with a theoretical decryption machine

Say we have an encryption algorithm that encrypts data blocks of 128 bits size, and makes them cipher blocks $C = E(P)$ without chaining. Also assume there is a linearity rule for XOR: For every pair ...
4
votes
3answers
3k views

Which one of the Block Cipher modes is the best?

I have two questions regarding the Block Cipher Modes: Which one of the modes is considered the best? I know CBC has a problem of IV since the next block of the plain text is XORed with the result ...
2
votes
1answer
335 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
1
vote
2answers
104 views

Correct way to read a given permutation cipher?

In some literature I am reading – where they are explaining the permutation cipher – they have two examples, which encrypt a small block of text. But they seem to contradict each other: First ...
2
votes
1answer
82 views

What's the advantage of using OFB/CFB/CTR modes over a stream cipher

As far as I understand: The primary disadvantage associated with stream ciphers is the need for a random and unique key for each run in order to protect against reused-key attacks. OFB/CFB/CTR block ...