Tag Info

Hot answers tagged

12

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...


8

If an attacker find some round key of AES256. Is it possible to find the master key ? If the attacker is given a single round key from an 256 bit AES key, it is infeasible to reconstruct the full key (even if you have access to chosen plaintext/ciphertext against the full key). This single round key reduces the number of possible AES keys from ...


5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...


4

As stated in the comments, dev/random already produces cryptographically secure random bytes which are perfectly adequate for use in encryption keys. Running these bytes through another CSPRNG is completely redundant. As far as I've understood, one of the options to create cryptographically secure keys would be to gather entropy from /dev/urandom/ and ...


4

There is no risk if the attacker knows part of the plaintext. This doesn't help to recover the rest of the plaintext. Even if the attacker knows all the bits but one, with any decent encryption algorithm, the attacker cannot tell what the last bit is from the ciphertext. After all, it happens all the time with known data formats. For example, if you ...


3

This is an answer to your revised question, although it doesn't seem to make any more sense: Hex is just another way to represent your data. It is neither more nor less secure than the binary representation or any other representation. Its all about convenience when dealing with this numbers. As humans we tend to operate with data encoded in the decimal ...


3

A conceivable attack is inspired by this extract of LUKS On-Disk Format Specification Version 1.1.1, section 1: A partition can have as many user passwords as there are key slots. To access a partition, the user has to supply only one of these passwords. If a password is changed, the old copy of the master key encrypted by the old password must be ...


3

In this scenario, it is better to use AES-128 than AES-256 if you are to 0-pad a 128-bit key to 256 bits. If you 0-pad, the round key for round 1 is all 0s, and round 3 is effectively worthless as well. So now you are down to 12 effective rounds vs 10 for AES-128. Then you need to look at the effectiveness of the remaining keys. Here are some example key ...


2

AES-256 with $b$ bits of its key known is still secure against key recovery attacks with security level $(256-b)$ bits. Otherwise a shortcut key recovery attack on the regular AES-256 would exist, and the only known attack of this kind -- biclique attack -- does not scale to such subsets of the key space.


2

Actually, the document talks about Rijndael, not AES. Aren't Rijndael and AES that same? Well, not precisely; Rijndael is specified with a set of parameters that AES does not support; how example, how it works with different block sizes. AES is defined only with a block size of 128; Rijndael supports a set of different block sizes. That is where your ...


2

The reason why you see this gibberish is that the key is random and simply interpreting it as a string of characters doesn't make sense and can lead to all kind of mistakes. You should inform yourself about hashes! Once you hash something, you are not able to retrieve the original value, so I would guess you don't want to do that. Hashes are not about ...


2

First of all, I suggest you to try use as IV first 16 bytes of encrypted file. Because in general IV is the first block of ciphertext. But if that doesn't work, then – of course – you can decrypt all message except first block. Just use first block as IV, and start to decrypt from second block. That will work because CBC does not provide integrity, and ...


2

T' method was introduced in the paper Cryptanalysis of Block Ciphers with Overdefined Systems of Equations by Nicolas Courtois and Josef Pieprzyk (see section 6.1 and Appendix E). It is a part of XSL attack on block ciphers (such as Rijndael and Serpent). During XSL attack cipher is represented as a system of multivariate quadratic polynomials and the goal ...


2

Just for completeness sake, CBC is defined as follows: The error you have made is that: $$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation) You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.



Only top voted, non community-wiki answers of a minimum length are eligible