ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

learn more… | top users | synonyms

42
votes
7answers
49k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better? Edit: This question was asked long back when I was ...
36
votes
1answer
35k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
24
votes
1answer
17k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and seen code ...
17
votes
3answers
2k views

Hashing or encrypting twice to increase security?

Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has ...
15
votes
3answers
1k views

Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
14
votes
5answers
4k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
14
votes
3answers
1k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50KB). For encryption, my app uses AES 128 bit in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
14
votes
2answers
550 views

Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
14
votes
1answer
1k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
13
votes
2answers
6k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
13
votes
2answers
11k views

AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
13
votes
1answer
7k views

Compare Blockmode CBC (with diffuser) against XTS

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC ...
12
votes
2answers
5k views

Why do we need special key-wrap algorithms?

Wikipedia says: Key Wrap constructions are a class of symmetric encryption algorithms designed to encapsulate (encrypt) cryptographic key material. We are using these algorithms to encrypt ...
11
votes
3answers
3k views

Is using a predictable IV with CFB mode safe or not?

While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine): "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
10
votes
1answer
7k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is ...
10
votes
1answer
2k views

Why not use CTR with a randomized IV?

I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
10
votes
1answer
1k views

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

It seems the only specified CTR mode ciphers in TLS are all GCM based. GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
9
votes
1answer
2k views

Deterministic nonces in CTR mode

I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
8
votes
2answers
2k views

Why should I use Authenticated Encryption instead of just encryption?

There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption. Why should I use an authenticated ...
8
votes
3answers
5k views

Encryption with “constant” initialization vector considered harmful

I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice. For stream ciphers not doing ...
8
votes
3answers
1k views

Using a Non-Random IV with modes other than CBC

The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
8
votes
1answer
5k views

What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...
8
votes
2answers
5k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
8
votes
3answers
1k views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
8
votes
1answer
2k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
7
votes
3answers
736 views

Is this encryption algorithm build from MD5 secure?

I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
7
votes
2answers
310 views

Will varying plaintext compensate for a fixed initialisation vector?

This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest. I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
7
votes
1answer
1k views

How can disk encryption systems (like Truecrypt) resist frequency analysis when they allow random access?

I don't understand how disk encryption (e.g. TrueCrypt) is supposed to resist frequency analysis. If blocks can be randomly accessed (which they can), doesn't that mean that frequency-domain ...
7
votes
1answer
268 views

Why is authenticated CFB mode insecure?

I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it: Let $P_1,P_2,\ldots P_n$ be the ...
7
votes
1answer
672 views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
7
votes
1answer
84 views

KFB mode - key feedback

Please, could someone explain to me how the Key feedback mode (KFB) mode works and what the IV in output block stands for? And what properties does the "constant input" has to provide? Should it be ...
7
votes
1answer
253 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
6
votes
2answers
4k views

AES plaintext is smaller than 128 bits - how to expand?

We are currently developing a little AES implementation in a crypto-course at university. As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
6
votes
2answers
575 views

Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?

As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so: ...
6
votes
3answers
894 views

CBC - a canonical mode, even though there are streaming modes

Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
6
votes
1answer
440 views

Why doesn't CTR mode require blocking?

I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
6
votes
1answer
763 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
6
votes
1answer
2k views

Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?

I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
6
votes
1answer
95 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
6
votes
1answer
363 views

Single-purpose symmetric encryption scheme for single files

I'm writing a simple password manager program that will encrypt/decrypt a single file (it's size will most likely stay under a few K). This is my initial file format design: ...
6
votes
2answers
161 views

Abstracting primitives and modes of operation

I am developing a symmetric crypto library and have reached a roadblock. Looking at block ciphers, it is quite obvious that all block ciphers are trivially abstractable as a simple primitive ...
5
votes
3answers
633 views

What is the difference between a 'cipher' and a 'mode of operation'?

What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)? Aren't these both terms for the encryption/decryption technique?
5
votes
2answers
564 views

How do we compute IV+1 in CTR mode?

This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation? For example, if I have the IV ...
5
votes
3answers
2k views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil ...
5
votes
2answers
3k views

Replay attack in ECB mode

How do replay attacks work in ECB mode? I found this in Wikipedia: "ECB mode can also make protocols without integrity protection even more susceptible to replay attacks, since each block gets ...
5
votes
2answers
325 views

Why is it said that if we have a duplicate ciphertext block it can leak our information?

I have been recently going through a question: http://security.stackexchange.com/questions/15767/what-do-key-size-and-block-size-mean-in-cryptography and it created in me a series of doubts. Referring ...
5
votes
2answers
284 views

Choice of authenticated encryption mode for whole messages

There are several well-regarded block cipher modes for authenticated encryption which have made their way into standards and protocols: CCM, EAX, GCM, OCB, … If I am designing a new messaging or ...
5
votes
2answers
500 views

What (precisely) is a block cipher?

If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher. Now I thought what would ...
5
votes
1answer
197 views

GCM: Math behind update of AAD after ciphertext has been processed

In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper): Some AAD was sent ...
5
votes
2answers
232 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...