# Tag Info

7

Yes, AES-128 is intended to be the standard block cipher for building a secure and efficient symmetric cryptosystem using some block cipher operating mode, like CTR for encryption or GCM for authenticated encryption; efficiency can be particularly good when there is hardware support for AES and GCM. There might be better choices in the case at hand, like ...

6

SIV is a mode specially designed for this purpose. SIV-AES would be a good choice, but it has the same issues as AES-wrap; not many implementations. If you use a GCM you should make sure that the IV is unique (if your plaintext is ever not random you would otherwise be in problems). As for the password based key derivation function: yes, PBKDF2 is good, ...

5

An important principle in cryptography is "key separation" which holds that one should "use distinct keys for distinct algorithms and distinct modes of operation". Violating key separation often opens up avenues of attacks that may break confidentiality, integrity, or even recover the key. You can use a KDF to derive cryptographically independent keys from ...

4

I am assuming that you wish to consider this for standard encryption tasks, and I am going to ignore the specific reference to AES and talk about general block ciphers (pseudorandom permutations). The answer is that small block sizes are very problematic. In particular, they break when used for encryption of any reasonable amount of information. I will ...

4

What you are asking is a straight application of Format Preserving Encryption, which builds ciphers which input and output are in a constrained format (generically: common to input and output, hence preserved). The FPE field has many articles with proven techniques; and proposed standards, including BPS and SP800-38G Draft. Note: the method tentatively ...

4

For encryption or decryption of data that is encrypted on the fly, you can do that. For data you store you obviously have to use the same decryption, so if you encrypt a huge file using AES, you have to decrypt it using AES, even when on battery power. First thing: If there is hardware support for AES, AES will be faster and using less power almost certain. ...

3

The best solution depends on the details of your application, but I have one comment and one suggestion. First the comment: You say you have AES hardware available. I don't know the details of your platform, but this hardware is likely to be much more efficient in time/power than a software implementation of any reasonable encryption algorithm. You need ...

3

As you said you are OK with a little bit less security in the more performant algorithm, I suggest Speck for that. It was developed by the NSA, so although some might worry about a backdoor (I personally doubt there is one though I would not know the difference if there were), it probably also means that ordinary people will not break it easily if at all. ...

3

Verilog is Turing complete, so you can implement any algorithm in Verilog, if you really want to.

3

If we assume that AES is a pseudorandom permutation (which is a standard model for block ciphers), then AES can replace the HMAC in your construction. Be aware, this only works because you have a fixed message length, i.e. the protocol must not accept nonces $> 128$bit. Besides, I guess you are aware of this but you have a shared secret key among all ...

3

You don't actually need 384 bits of key material. The IV for GCM does not need to be secret, and may be chosen deterministically, e.g. as an incremental counter. Thus, you only need 256 bits for the AES key, which you already have. That said, if you did actually need more key material, you could use any standard KDF to expand your 256 bits. Since you ...

3

The answer is yes. There is no problem with sending the IV in the clear. So, this is fine. Likewise, the salt is not there to add entropy so this is also fine. Having said that, I understand from the code that the application is not using a uniformly distributed (and so high entropy) key. This is a problem and very bad, since it is easy to carry out a ...

3

Wouldn't encrypting a message with AES, then encrypting the (randomly generated) AES key and IV with the EC public key suffice? Yes it would suffice and is what is usually done. However for this to work you'd have to have a way to reliably convert a random integer to a curve point and back which isn't trivially possible. And even if you could reliably ...

2

ECIES may seem complex, but if you try another approach, you would end up with something very much like it. If you only encrypt with AES, then you are not authenticating, which is most cases you also need to do. If you then encrypt and authenticate by yourself, you pretty much reinvented ECIES. But yes, ECIES is in higher layer of abstraction compared to ...

2

The RAR5 archive format encrypts file data using AES in CBC mode, and generates a 256-bit key using PBDKF2-HMAC-SHA256 (32768 iterations default?). If an attacker is able to view many files encrypted this way all with the same key, the attack is to recover the key from the ciphertext. This is not an easy task, even if the IV was reused. In WinRAR, the IV ...

2

The schemas from the relevant Wikipedia page really explain it all: As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the IV impacts only that block. When encrypting, though, modifying the IV alters the first ciphertext block, then the second ciphertext block, and so on. The ...

2

It’s tested against many of the test-vectors (key varying, plaintext varying, Monte Carlo), which is the only contract it needs to fulfil... I've got some speed/timing information now: 128 bit, key setup 0.37ms 128 bit, ECB, encryption 0.58ms / block (27.5kB/s) 128 bit, ECB, decryption 0.77ms / block (20.5kB/s) 192 bit, key setup 0.41ms 192 bit, ECB, ...

2

What you are looking for is called white-box cryptography. In short white-box crypto aims to make an implementation of a cypher (for example AES) in such a way that it is impossible for an attacker to extract the key, even if the attacker (the user of the computer) has access to the source code and a debugger. Up till now all academic white-box ...

1

This is called steganography and while the example you give is not significantly better than just having the AES in a "text file" (because it would not look like an actual PNG file), there are algorithms for hiding information in a "cover" file. However, if you do not mean to hide the fact that you have encrypted something, using AES alone is normally ...

1

"Hiding" content in an image (or other medium, it's a general technique called steganography) can be done either in a very obvious way (a dedicated data block, called ancillary chunk, which does not form part of the image), or it can be more effectively hidden in the low order bits of the image, thus very subtly degrading the picture. Both methods can be ...

1

If I'm understanding your question right, you're asking "How to brute-force the Bitlocker encryption without being able to install stuff and without using "backdoors" and without having the key-file (if used)?" You can't brute-force AES-128 without the said key-file. The reason for this is that the key file contains the 128-bit keys which are too hard to ...

1

This kind of key management problem is a big reason why encryption is not more widely used for everyday data. I see a single easy way to do this, I think it is similar to the way disk encryption systems work, and it may not work for your uses. For each file, a random key $kf$ is generated. 2 copies of the key are encrypted, one with a key derived from the ...

1

Now I would like to use a single-block AES128 for the HMAC calculation in this scheme [...] HMAC requires a hash function with a variable input size, so you cannot just use AES in it. If you want to use some other MAC instead of HMAC, you can use AES. AES ECB is a secure MAC for single block messages, so that would work. Given this answer to a ...

1

Yes it is a normal matrix multiplication but within Galois finite field. We have to use Galois defined operations of $+$ and $\cdot$. Example might clarify everything. Let's say we have the $b'$ vector, and it's value is $170 = 10101010b$ Just remember tat $b'_0$ is the least significant bit of that value. \$b_0 = (1 \wedge b'_0) \oplus (0 \wedge b'_1) ...

1

Modern computers are quite fast, and modern cryptographic algorithms are quite efficient. Most computers benchmark hardware accelerated AES in CTR mode well above 1GB/s, which would be a fraction of a millisecond for a 100KiB file. Since the standard system timer generally runs at 1ms intervals, the entire encryption operation ([file data] XOR [AES] XOR ...

Only top voted, non community-wiki answers of a minimum length are eligible