Hot answers tagged

16

If you "crack the AES", a very hypothetical assumption, then you could simply parse the WiFi packets and decrypt the messages that are being send. Cracking AES is however considered impossible. AES-256 is even considered secure against attacks that involve (somewhat less hypothetical but still unavailable) quantum computers. Note that even RC4, which was ...


11

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself. These parameters may very well include: version number of the ...


8

It would appear that this is as a consequence of the Wassenaar Arrangement (more detailed explanation). Basically, because cryptography falls under certain laws regarding munitions and arms trafficking there are restrictions on the strength of the cryptography you are allowed to sell (if the product is not a mass market product). It would appear that the ...


8

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be changed or separated. (Conceptually, the MAC is computed over the AAD and the ciphertext together.)


7

This is identical with CTR mode encryption with a MAC. That's known to be secure. It doesn't say in your question if: the Ai blocks are completely unique; the header is included in the MIC calculation. If those preconditions are met then I don't see any issue with the protocol. The first one I cannot verify but seems likely, the second one is certainly ...


6

Can exponent be random number just like it is now or it should be a prime too? There is no particular advantage to be gained in selecting only prime exponents. Is using dynamic modulus and generator better idea? Whether it makes sense to use dynamic modulii is currently under debate. There are known algorithms that make attacking multiple discrete ...


6

Coincidentally I had the Twofish and Camellia design papers open on my computer when you asked this question. S-boxes in the ciphers Both are Feistel ciphers, and the way the s-boxes are used is quite different when compared to AES. The s-boxes are used almost identically in Twofish and Camellia, but key mixing and post s-box diffusion are quite different. ...


5

Any of the ways you listed would work. If you're collecting alternatives, yet another one (which I have seen in practice) is to include the message counter as the AAD (additional authenticated data), which is another input to GCM. When we consider which one would be the best, we note that GCM has absolutely no requirement that the nonce be "random", or for ...


5

Yes, if your ciphertext is repetitive, that's bad. We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is kind of bad. Or it could be e.g. because you're using AES in CTR mode with a fixed IV, which would be worse. Or, in principle, you might be using a ...


4

The simple answer is "Because its an SPN cipher". What is difference between Feistel and SPN? SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then operate upon X parts where 0 In balanced, data is divided in Two parts i.e N = 2, and X=1 (example is camellia cipher) In Unbalanced, data is divided in more ...


4

As indicated, the header format of your proprietary encryption is entirely up to you. Still, as I see this forgotten or done imperfectly a lot of times, I'll give some general hints in the right direction. First of all, complexity is the enemy of security. If you make your header overly complex you may get into trouble. It could be possible to generate ...


4

The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key? Suppose all we had was secret keys and the XOR operation. Well, actually, it is possible to build a secure cipher out of that, called the one time pad. One time pads offer perfect secrecy, but suffer ...


3

All of the mathematical operations within the s-boxes, shift row, and mix column should be known to the attacker, correct? Yes, see Kerckhoff's principle I understand they could be hard to calculate but aren't they static operations for the most part? I'm interpreting "static operations" to mean subBytes + shiftRows + mixColumns + addRoundKey, and that ...


3

Short answer: Not enough. The AES algorithm is defined in the FIPS standard with keylenght of 128, 192 or 256 bits. So you cannot use directly a 56-bit key. One needs to have a key with the proper length to use the AES encryption algorithm. Data will be protected using AES-256 encryption with a 56-bit effective key length probably means that the key ...


3

If the effective key length is 56-bit, that means you have to enumerate only 56-bit. It's not secure at all. From Wikipedia: In February 1997, RSA Data Security ran a brute force competition with a $10,000 prize to demonstrate the weakness of 56-bit encryption; the contest was won four months later. In July 1998, a successful brute-force attack was ...


3

No, this is not a terrible idea, this is an idea that is often used. Basically you've described the main use of a symmetric block cipher for exactly the block size of AES. AES is fully deterministic and not reversible without the key. A block cipher is a Pseudo Random Permutation (PRP) - basically a map - from a set of all possible plaintext to a pseudo-...


3

Since this is still open and the issue keeps coming up: TLDR: There are lots of things in OpenSSL that implement standards including AES, but the key derivation part of enc is partly nonstandard First, OpenSSL has several commandline operations it calls commands (although they usually aren't separate programs, as typical commands are on Unix), and a whole ...


2

"I'm using [AES] in CBC mode, but the implementation doesn't add the randomness I want, the same message when encrypted looks the same." This is a problem. If you were using CBC mode correctly (i.e. with a random IV), then encrypting the same message twice would produce completely different ciphertext. Since you're not using CBC mode in the way it's ...


2

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight 128-bit AES blocks in parallel, using eight 128-bit XMM registers to store them. They're not doing basic "naïve bitslicing", which would involve using 128 $n$-...


2

TL;DR: Chances are there are no attacks against this scheme. What you are describing sounds exactly like a chosen-plaintext attack, e.g. you can query an oracle to encrypt plaintexts of your choice (using the oracle's random IVs). Now, this attack is already stopped by AES-CBC which is provably immune to this sort of attack. And furthermore it seems like ...


1

Here is an example encoder / decoder of pairwise IDs that we use in OpenID Connect, based on AES/CBC/PKCS5Padding encryption.


1

Unlike others I don't think that cracking AES is that unlikely - but then I have a rather strict definition of the semantic security of encryption algorithms... The following scenario seems most likely to me (and resembles for example how WEP was cracked). Note first, that a single cyphertext will produce several valid WPA2 packets when decrypted with ...


1

The Encryption is not likely Compression where one can choose Normal, High or Low or something from scale of 0-100 as you mentioned. If you really want to do it, you can think of it in two ways Reduce the keyspace, as already mentioned in an above answer Reduce the Rounds. But these both will lead to a situation where you may end up in a breakthrough (...



Only top voted, non community-wiki answers of a minimum length are eligible