Hot answers tagged

10

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a classical no-whitebox implementation on a different platform. The goal is that an attacker having access to the whole computation and intermediate values cannot ...


9

Is there any worthwhile way to authenticate the message using only these functions and simple checksums? As usual, of course there is: AES-CCM! AES-CCM basically is CTR mode with a tagged-on CBC-MAC and length prepending. You can implement CTR trivially using your ECB primitive and CBC-MAC shouldn't be too hard to implement given a CBC primitive and ...


7

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...


6

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. Well, that rather depends on the type of side channel attacks you are interested in protected against. You specifically mention Power Analysis (SPA and DPA) type attacks; the first obvious question would be: could those ...


5

If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey using the flaws in AES ECB? No. ECB is flawed, but not that flawed. At worst the attacker can know the encryption of a message if they have already seen the same ...


5

The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of the table here so that you can see. The code used to produce this table can be found here. Disclaimer: This is my personal github. If by "uniform", you mean ...


4

ECB mode has several weaknesses as discussed in Why shouldn't I use ECB encryption? but in this specific case, it does not allow to gain information about the secret key AppKey involved. Indeed, encrypting the same block with the same AppKey will returns the same ciphertext. But in the LoRaWAN join-accept message, it does not matter because the server ...


3

This '.' is not 'AND' operation , its modular multiplication in the Galois Field $$GF(2^8)$$ and other operation $$\oplus$$ used in Mix Column Step of AES encrytion is modular addition in the Galois Field $$GF(2^8)$$. Here is a link to youtube channel by Christoff Paar where you can understand well, Watch lecture 7 and 8. Hope it helps.


3

Since any cipher must be able to decrypt every message that it encrypts, it follows that, given a fixed key, any cipher must be an injective function: In mathematics, an injective function or injection or one-to-one function is a function that preserves distinctness: it never maps distinct elements of its domain to the same element of its codomain. In ...


2

No, assuming AES is secure. That would be a known-plaintext attack.


2

I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where continuous data (that may not be available all at once) is to be encrypted (e.g., real-time data). No, this is not accurate. The block size of AES is just ...


1

You can check this answer which mentions how does the IV generated for GCM ciphers in TLS 1.2 ... is an AEAD Cipher, so it is in the form of GenericAEADCipher: struct { opaque nonce_explicit[SecurityParameters.record_iv_length]; aead-ciphered struct { opaque content[TLSCompressed.length]; }; } GenericAEADCipher; Here, the ...


1

The Siegenthaler result is for boolean functions, i.e., $f:F_2^n\rightarrow F_2$, while you are considering vectorial boolean functions $$f:F_2^n\rightarrow F_2^n$$ so you can't apply it. The results in this area are quite technical. Some overview: You could certainly compute resilience (hence correlation immmunity for AES Sbox) by using the definition ...


1

AES S-box DDT is not uniform but it has a higher resistant to differential attacks than DES because of maximum probablity of input output pair of differential is 4/256.


1

The answer "GCM is a good option as it combines encryption and integrity in one mechanism. " is a bit misleading. GCM uses one after another: 1-st encryption in counter mode and then GHASH to authenticate the data. In the recent intel processors CLMUL-NI is used to speed up the GHASH operations. Benefits of GCM over CBC+HMAC: is much faster, as the ...


1

I maintain the fastest implementation of pure Python aes It's reviewed in so far as it passes unit tests in __main__. Patches for more thorough testing are welcome. My fork of pythonaes made the decision that it's the crypto kernel to the point that it requires prepadded input



Only top voted, non community-wiki answers of a minimum length are eligible