Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
1
vote
1answer
88 views
How much data can I encrypt with AES before I need to change the key in CBC mode?
In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.
It seems that ...
3
votes
1answer
101 views
Alternatives to HMAC + CBC?
I'm looking at using HMAC + CBC. The combination looks like this:
ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext
Where:
...
-3
votes
0answers
86 views
Why is the basic (fixed-length) CBC MAC construction not a secure MAC when it is used on variable-sized messages? [closed]
Why is the basic (fi xed-length) CBC MAC construction not a secure MAC when it is used on variable-sized messages?
-2
votes
0answers
54 views
What is a CBC Mac Scheme? How does knowing one block release other? [closed]
I guess CBC-MAC encryption relies on the previous block for encryption but how does knowing intermediate block cipher output make it insecure?
1
vote
2answers
139 views
Is it worth applying a MAC on data in a HSM?
I'm building a basic HSM out of an Arduino, and am using the following scheme to store data:
Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction).
Secondary ...
5
votes
2answers
189 views
Is encrypting a single 128 bit block with AES ECB “safe”
I want to encrypt a small piece of data that is less that 16 bytes in size (think SSN), and I'll be using a 256bit encryption key. The typical suggestion is to never use ECB, but if there is just a ...
2
votes
1answer
102 views
Can prepending “junk” be equivalent to an IV when encrypting using CBC?
We are encrypting a small positive integer (1-1000) with a constant key using AES256 encryption. We are considering two approaches to make this secure; use an initial vector (which we then need to ...
8
votes
2answers
2k views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
1
vote
1answer
72 views
Ciphers in CBC mode reveal place of change in plaintext
Theoretically, when using a symmetric block cipher in CBC mode, the current block is dependent on the previous block. Suppose one plaintext is encrypted using CBC, and then one bit of it is changed, ...
3
votes
1answer
129 views
What are the constraints for an IV using AES in CBC mode?
I'm designing a protocol for use into a VPN software.
The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
1
vote
1answer
63 views
What is the usual block cipher mode that goes with CTS
I am just wondering what is the most common, or most used, block cipher mode used to goes with CTS?
ECB or CBC?
2
votes
2answers
149 views
Is storing original file size in an encrypted file header a bad idea?
I'm encrypting a file using AES-256 in CBC mode. I'm padding to the 16-byte input multiple by using the PKCS#7 limit. The problem I'm currently having is that if I'm transferring or reading the ...
2
votes
2answers
183 views
Validating successful decryption in AES
I have a program which uses AES-256 in CBC mode to encrypt and decrypt files. As I have quickly realized, AES will even use an incorrect passphrase to decrypt data, which leaves me with no way to ...
2
votes
0answers
57 views
Implementing PKCS#7 Padding on a Stream of Unknown Length?
I have a fairly simple Python program using PyCrypto to use AES+CBC to encrypt a stream of input. In order to adhere to the 16-byte input size multiple, I've implemented PKCS#7 by hand. (While I know ...
1
vote
1answer
163 views
Use of CBC-AES-256 to encrypt usernames
I came across some code in our project that encrypts usernames (limited to 50 chars, most are less than 10) using the following parameters:
IV size is 16 bytes
Key size is 32 bytes
Algorithm is ...
0
votes
1answer
160 views
How to break AES CBC with PKCS#5 padding?
If I have a string encoded with AES CBC with PKCS#5 padding, how can one possibly decrypt/crack it? What are the approaches that one can take to break its security?
0
votes
1answer
90 views
AES CBC with fixed or predictable IV, what are the risks?
I am making a call with parameters from application "A" to a web application "B".
Parameters are in the query string of the URL. They don't need to be hidden.
But I want to be sure that nobody can ...
4
votes
5answers
322 views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
1
vote
1answer
84 views
Understanding padding oracles - is an attack plausible in my scenario?
I have a scheme that, long story short, uses AES in CBC mode to encrypt third-party credentials for user accounts with a password-derived key. It's been mentioned that the use of CBC mode is a ...
3
votes
0answers
96 views
CBC with fixed IV but changing data [duplicate]
Possible Duplicate:
Using CBC with fixed IV
I am using AES in CBC mode.
For some reasons I have some issues for transmiting the IV. So I am using a fixed IV.
If the first 128bits of the ...
1
vote
1answer
256 views
AES CBC mode or AES CTR mode recommended?
what's benefits and disadvantages of CBC vs CTR ? which one is more secure ?
2
votes
0answers
154 views
Why not use CBC, not send IV, and assume first plaintext block is garbage? [duplicate]
Possible Duplicate:
Using CBC with fixed IV
Forgive me if this has been asked before, I looked but haven't seen any answers that suit.
Is there any danger in using CBC, encrypting a ...
3
votes
1answer
361 views
Compare Blockmode CBC (with diffuser) against XTS
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC ...
3
votes
3answers
330 views
Relative merits of AES ECB and CBC modes for securing data at rest
I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.
I assume the ...
0
votes
1answer
100 views
Is there a better mode of operation than CBC? [closed]
Given the wealth of vulnerabilities that have been found in CBC-constructions (Padding Oracle Attacks, BEAST, etc.), is there something else we should be using instead?
2
votes
2answers
235 views
Modifications of CBC-MAC
I'm preparing myself to exam, but I have a lot of troubles with rigorous proofs. This post is very long, but this is because I remind here 2 long definitions.
At the beginning I want to remind the ...
2
votes
1answer
345 views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
1
vote
2answers
415 views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
4
votes
1answer
330 views
Why is CBC with predictable IV considered insecure against CPA
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that is uses, the attacker can ...
1
vote
1answer
1k views
How to decrypt AES in CBC
i am having problems understanding how CBC works! I know that it is a chain and the IV is XORed with the PT but then what? I mean we encrypt it with key k and the result is the CT which we use for the ...
1
vote
3answers
325 views
Malleability attacks against encryption without authentication
Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block:
...
1
vote
2answers
178 views
Secure Hash Function based on AES
How secure would a hash function be which appends an extra block of 16 zeroed out bytes to the end of the message and then AES-encrypts it with a well-known password (say the first 128 bits of pi) ...
0
votes
1answer
98 views
How do I calculate the maximum plain text length allowable for a certain cipher text length?
I am encrypting and storing sensitive values in the database. I have a set max length in the database, but in order to provide useful user feedback, I'd like to know the max input I should allow for a ...
3
votes
3answers
416 views
Why does CBC decryption with a wrong IV still give readable results?
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.
My encryption was correct. I was generating a random IV block and writing ...
0
votes
1answer
181 views
Why does my implementation of CBC mode only decrypt the first block correctly? [closed]
I have the following code that uses a CBC mode to encrypt a text by dividing it to 3-elements block. But it only works correctly on the first block which is xored with the IV.
...
3
votes
0answers
216 views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. ...
1
vote
2answers
1k views
Initialization vector length insufficient in AES
I use AES with AES/CBC/PKCS5Padding with the following encryption and decryption code sections in Java:
...
5
votes
2answers
302 views
Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
I was not able to understand why we practically need a CPA security in Cipher Block Chaining. (which insist on having a random IV), let say if the encryption is not CPA secure i.e , the adversary can ...
6
votes
1answer
381 views
What causes first block of AES decryption to be garbled, even with correct IV?
I am attempting to duplicate wireshark's packet capture decryption for a TLS HTTP session, where I control the private key of the server.
The cipher suite number is 0x00002f, TLS_RSA_AES_128_CBC_SHA
...
5
votes
1answer
254 views
CBC key lifetime, or, “how big is too big?”
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
7
votes
3answers
758 views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
2
votes
2answers
703 views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = ...
2
votes
3answers
1k views
Which one of the Block Cipher modes is the best?
I have two questions regarding the Block Cipher Modes:
First: Which one of the modes is considered the best?
I know CBC has a problem of IV since the next block of the plain text is XORed with the ...
3
votes
1answer
183 views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
5
votes
1answer
1k views
How do I correctly derive a Key and IV?
Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class).
This encryption code will be used in conjunction with existing ...
12
votes
3answers
793 views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
3
votes
1answer
446 views
Encrypting (CBC) identical files with same key and different iv, is it less secure?
I would like to learn more about cryptography.
Let's say you encrypt multiple files with CBC encryption using the same key, but each file has unique (and pseudo random) iv. Does this weakens the ...
7
votes
1answer
1k views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is ...
11
votes
4answers
5k views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
3
votes
3answers
269 views
Does the XML Encryption flaw affect SSL/TLS?
A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated:
XML Encryption Flaw Leaves Web Services Vulnerable.
Does this weakness of CBC-mode which is used here also ...
