A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.
2
votes
1answer
1k views
How to solve MixColumns
I can't really understand MixColumns in Advanced Encryption Standard, can anyone help me how to do this?
I found some topic in the internet about MixColumns, but I still have a lot of question to ...
-4
votes
0answers
29 views
pseudo random sequence and permutation functions [closed]
Iam doing my Master thesis in enhancing of an encryption algorithm by using of a pseudo random sequence generators to create a 16*16 shared table and apply a permutation function on it. one of the ...
1
vote
3answers
670 views
Does encrypting twice using the same block cipher produce a security weakness?
If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.
...
3
votes
2answers
183 views
AES - plaintext is smaller 128 bit - how to expaned?
we are currently developing a little AES implementation in a crypto-course at university.
As far as I know, AES uses 128 bit blocklength, so all data that will be encrypted will get split up into ...
3
votes
2answers
304 views
How were the number of rounds for different key sizes of AES selected?
The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
1
vote
1answer
114 views
AES AddRoundKey
Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?
10
votes
2answers
3k views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
2
votes
2answers
132 views
Why is $h(H, m) = E(m, H) \oplus m$ insecure?
I am taking a cryptography class on Coursera. I learned that the compression function $h(H, m) = E_m(H) \oplus m$ is insecure (even though other variants like Davies-Meyer or Miyaguchi-Preneel are ...
1
vote
1answer
54 views
Why are the Davies-Meyer and Miyaguchi-Preneel constructions secure?
The Davies-Meyer compression function $h(H, m) = E_m(H) \oplus H$ is said to be secure. So too is the Miyaguchi-Preneel compression function $h(H, m) = E_m(H) \oplus m \oplus H$. Why are these ...
0
votes
1answer
103 views
Ciphertext-only attack on Simplified DES
Is it possible to deduce the plaintext block or the key, given only a Simplified-DES ciphertext block (e.g. c=01110110)? I'm reading Cryptography And Network Security, by William Stallings and I'm bit ...
0
votes
2answers
89 views
Do I need to know the “mode of operation” to decrypt a message encrypted with a block cipher?
If I have received an AES encrypted message, and if I do know the key with which it was encrypted, do I also need to know the mode of operation with which it was encrypted in order to decrypt it? My ...
1
vote
1answer
65 views
Is there a preferred way/standard on how to transmit an initialization vector for AES encryption
Is there a preferred way on how to transmit the initiliazation vector with witch AES encryption was made? I could imagine that, if the encrypted data is stored to a file, the IV is preppended at the ...
2
votes
1answer
212 views
Is AES-256 a post-quantum secure cipher or not?
We know Grover's algorithm speedup brute-force attacks two time faster in block ciphers (e.g brute-forcing 128 bit keys take $2^{64}$ operations not $2^{128}$).
That explains why we are using 256 bit ...
0
votes
1answer
96 views
Is there an efficient way to hide the encrypted plaintext length with a block cipher?
In block cipher modes of operation for encryption on input of a plaintext of $N$ blocks (We assume that the input size is always a multiple of the blockcipher mode: $N·16$ bytes) the size of the ...
1
vote
1answer
62 views
What is the usual block cipher mode that goes with CTS
I am just wondering what is the most common, or most used, block cipher mode used to goes with CTS?
ECB or CBC?
4
votes
4answers
504 views
Is SHA-256 secure as a CTR block cipher?
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.
We represent numbers in simple binary instead of a counting function. ...
1
vote
1answer
67 views
How to secure a mental poker protocol?
I would like to implement a mental poker protocol in a secure fashion. How should I go about that without (preferably) infringing on the Mental Poker Framework patent?
5
votes
1answer
489 views
Why is CAMELLIA suddenly so widely used?
When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.
Is that not ...
2
votes
0answers
77 views
Are there any secure commutative ciphers?
This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure.
My question is, here there any commutative ciphers out there that are secure ...
2
votes
1answer
93 views
Security of Pohlig-Hellman exponentation cipher?
I am looking into implementing Pohlig-Hellman exponentation cipher and I would like to know how secure that algorithm is? I am guessing it's security relates greatly to the prime number used in it. ...
1
vote
1answer
125 views
AES key/ciphertext space sizes
This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
3
votes
1answer
94 views
Low complexity implementation of a small blocksize cipher (< 64 bit)
Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE.
This one in particular suggests using AES as the round function of a Feistel network.
The ...
1
vote
1answer
170 views
Can we replace the XOR operation in DES with some other operation?
Can we replace the XOR operation in the DES algorithm with some other operation? If so, does it work for both encryption and decryption?
1
vote
1answer
61 views
What are rounds in the context of ciphers?
Another recent question on security margin included in its answer the discussion of how many rounds are broken so far. What is the definition of a round?
4
votes
3answers
145 views
What is a block cipher?
I have read about block ciphers, but I do not understand the topic completely.
Is a block cipher a way to send data or a way to encrypt data?
How is the data divided into multiply blocks before it ...
10
votes
2answers
998 views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
4
votes
5answers
320 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
6
votes
1answer
373 views
Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)
Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size ...
4
votes
2answers
159 views
Is it possible to break a hash-based block cipher?
Let's define the following block cipher:
$C_n = M_n \oplus H(k + n)$ where $C_n$ is the nth block of ciphertext, $M_n$ is the nth block of plaintext, $H$ is a cryptographic hash function, and $k$ is ...
0
votes
2answers
143 views
0
votes
1answer
171 views
Break double encryption
Let $E_k$ : {0,1}$^l$ be a block cipher encryption function with block-size $l$ and key-length $n$.
In class, we saw that a double encryption with two independent keys $E{}'_{k_1k_2}(x)$ = ...
4
votes
1answer
129 views
Does Grover's algorithm effect block size or only key size?
We know that Grover's algorithm can speed up cracking symmetric keys. Basically the key space is halved. This means we have to use at least a 256 bit key (to get 128 bit security).
I heard somewhere ...
6
votes
2answers
701 views
Why do block ciphers need a non-linear component (like an S-box)?
Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)?
How does it make the cipher more secure?
The only intuition I have ...
4
votes
1answer
153 views
Can a nested block cipher avoid the meet in the middle attack by using a secret initialization vector for the inner encryption?
It seems to be believed that encrypting twice with a block cipher using an independent key each time is not as secure as you might expect because of the "meet in the middle" attack.
This is an attack ...
2
votes
1answer
2k views
How to use RCON In Key Expansion of 128 Bit Advanced Encryption Standard
I have a question about RCON
here is my illustration...
this is the 128 bit key..
...
1
vote
2answers
137 views
AES Key Length vs Block Length
This answer points out that certain key and block lengths were a requirement for the AES submissions:
The candidate algorithm shall be capable of supporting key-block combinations with sizes of ...
2
votes
1answer
102 views
What is an oracle adversary?
I'm trying to figure out block ciphers and this is the first time I've encountered the term "oracle adversary". It appears in the context of defining a PRP and a PRF. Can someone please explain what ...
27
votes
4answers
5k views
What are the practical difference between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants (AES-128, AES-192, AES-256), but why would I use one over another?
1
vote
2answers
108 views
What cipher mode is suitable for independantly decryptable short messages?
I'm building a small VoIP client which transmits encrypted audio data via UDP, and some packet loss is expected, so each packet will need to be decrypted separately even if others in the stream don't ...
4
votes
2answers
126 views
Will varying plaintext compensate for a fixed initialisation vector?
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.
I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
2
votes
1answer
1k views
Difference between stream cipher and block cipher
A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time.
A block cipher ...
9
votes
3answers
3k views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
6
votes
1answer
276 views
Hash function from narrower block cipher operated in CBC-encryption mode?
I am trying to build a public hash function (thus collision-resistant and preimage-resistant, and more generally behaving like a random oracle), with input a message $M$ of fixed size $|M|=m\cdot b$ ...
1
vote
1answer
292 views
How can I implement the “Multiplication Modulo” and “Addition Modulo” operations in IDEA?
I am currently working on IDEA (International Data Encryption Algorithm), and I don't know how to perform Multiplication Modulo and Addition Modulo.
This is how IDEA operates:
IDEA operates on ...
1
vote
1answer
136 views
How could block encryption in counter mode be secure from viewpoint of entropy?
A good block cipher e.g. AES running in counter mode is commonly considered to be secure. Assuming a perfectly random key, one could in this case from $128$ bits generate up to $2^{128}·128$ bits for ...
-4
votes
2answers
198 views
Why is there a strong distinction between stream and block ciphers?
If I don't err, in the literature a stream cipher is one in which each plaintext bit is processed individually, commonly via xor-ing with one bit of a random or pseudo-random bit stream, while a block ...
5
votes
3answers
636 views
Security of simple xor and s-box cipher?
What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode?
A cipher's internal primitive might be a simple as this:
$C = S[M \oplus k]$, where ...
1
vote
3answers
322 views
Malleability attacks against encryption without authentication
Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block:
...
2
votes
1answer
180 views
What are the safe ways to derive HMAC key using block cipher?
Suppose we have a state of block cipher initialized with some key unknown to us, that is, we have the state after running key schedule, but we have no access to actual key or subkeys, all we can do is ...
1
vote
1answer
124 views
How is block cipher padding verified for consistancy?
Under what circumstances is a decryption routine able to tell that the padding of a message is invalid? If a cipher text block where to be randomly modified, what is the probability that the padding ...
