# Tag Info

6

Let's clear some bullshit first: Now as the NSA GCHQ et al know very well the more efficient you make the implementaiton of crypto code the more side channels it has unless extream caution is observed. One thing we do know is that optomised for speed and minimized number of gates is an almost certain guarentee of side channels no matter how clever you ...

6

You should think of Rijndael's S-box as a function that maps bytes to bytes, where a byte (octet) is considered to be a member of a finite field of size $2^8$ (with xor as addition). It's not seen as a 16x16 octet array, really. The substitution is then just done byte-wise: every octet in the 4x4 block is replaced by its function value under the S-box ...

5

Absolutely. The key point is that, whilst in CBC mode, the encryption can be thought of as using the previous ciphertext as the IV - have a look at this diagram from wikipedia: I assume from what you've said that you have a function that will "do" AES-CBC decryption on large amounts of data, and you wish to use this. So, you simply run: $$D_k^{IV}(c_1\ ... 4 Well, there is no really good way; the encryption of the plaintext is E_k( Plaintext \oplus IV) (followed by 16 bytes which are a deterministic function of the first ciphertext block). The AES function E_k is designed to be totally unpredictable if you don't know the key, there's nothing to leverage there. The only thing that allows you to gain any ... 3 In terms of the question in the title, the mode of operation has no effect at all on the pseudo randomness of the underlying block-cipher. If a block cipher is pseudo random then it is pseudo random, regardless of the mode it is embedded in -- with the caveat that if we differentiate between (weak) CPA-resistant pseudo randomness and (strong) CCA-resistant ... 3 Yes, of course other modes have been studied. See this paper for one study, and that paper for another study. The bottom line is that CFB, OFB and CTR modes are also good PRFs (assuming you use random IVs). As for ECB mode, it is a good PRF if you limit it to inputs of precisely one block (128 bits for AES); it is not a good PRF if you are allowed to ... 3 Item 2 has been answered satisfactorily, so this will focus on point 1: the s-box. The size of the s-box is not a 16x16 array unless it is viewed as such. The s-box is actually an 8-bit non linear transformation of the input, and is only viewed as a 16x16 array if you arrange it as a table of such dimensions. This array would then be a 1 to 1 representation ... 3 standard AES disclaimer: Given the questions you've asked, you should not implement AES yourself in a real-world system because there are lots of security considerations when implementing ciphers. Think of the S-box as a function from byte  \to  byte. So, to look up the image of x under the s-box transformation, you simply use S_\text{box}(x), which ... 3 What are the properties of random padding (and I realize there are different ways to do it but I'm looking for an illustrative example) that allow it to be reliably removed from the message? You can do random padding with AES, but you'd have to reserve say the very last byte to tell how many bytes of padding were added. For example, for a 4 byte ... 1 We think that the player will not be able to get this key by extracting it from the memory or somehow else. Forgive me, but I'm skeptical. If you really have figured out a way to do this --- and plenty of well-funded, intelligent people have tried and failed --- I'd recommend slapping a patent on it and making millions off of licensing fees. How ... 1 "Serial concatenation" is not a standard term in cryptography. Without any further information, I would guess that it probably refers to just concatenation. If that's not what it refers to, then your spec is deficient and ambiguous; you'll need to consult with the author of the spec to ask for to clarify what they meant by that phrase. 1 AES-128 uses the full set \{0, 1\}^{128} as keyspace, and for each key the blockcipher is defined for each input block in \{0, 1\}^{128}. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block). So the answer to 1 is yes. For 2, we have this equation:$$AES_K(AES_K^{-1}(x)) = x We can decrypt both sides: ...

1

$V_{1}$ and $V_{2}$ should never be equal when using correct implementation of cbc by using the same input $(a,b,c)$. See following construction scheme: Even though you have two distinct encryption processes, namely one for $V_{1}$and another for $V_{2}$, the correct implementation of CBC uses an initialization Vector IV which has to be random. By xoring ...

1

For AES-128, the block cipher works on 128 bits at a time. Whichever block cipher mode you use (ECB, CBC, CTR, etc.), the encrypting will always be done on 128-bit blocks. The assumption is also made that padding is being used. Let's assume that $m = (a||b||c)$ and that $m' = (c||a||b)$. That gives us two separate messages, each 900 bits. Using ...

1

I'm going to assume that the comma $,$ operator used in your question means 'concatenate' (normally written $a||b||c$). Moreover, I'm assuming that $a,b,c$ are distinct. In that case, With incredibly high probability, No: $V_1$ and $V_2$ will not be equal. Think of it this way: if they were equal, then what would $D_k(V_1)$ be? Supposing $V_1=V_2$, we ...

1

To calculate the KCV for AES, you take the first three bytes of the encryption of zero under your key. Indeed, the case you've given is precisely this - the zero vector encrypted under the key 48C3B4286FF421A4A328E68AD9E542A4 is 77dc841daeb43315fed9acdf2f965f45, which restricts to 77dc84. In your question you say you already have AES-128 encryption, at ...

1

You do not mention any authentication of the ciphertexts. $\:$ If you could change the IV (which sounds highly unlikely) then you could make rather precise changes to the plaintext (as if it was a stream cipher). Ideally from your point of view, there may be a padding oracle attack (which I don't understand and so won't describe here). If you can change ...

Only top voted, non community-wiki answers of a minimum length are eligible