# Tag Info

21

AES is an algorithm which is split into several internal rounds, and each round needs a specific 128-bit subkey (and an extra subkey is needed at the end). In an ideal world, the 11/13/15 subkeys would be generated from a strong, cryptographically secure PRNG, itself seeded with "the" key. However, this world is not ideal, and the subkeys are generated ...

16

Blum-Blum-Shub is a stream cipher: given a short key, it produces an effectively unlimited-length stream of pseudorandom bits. Other well-known examples of stream ciphers include AES-CTR and RC4. Blum-Blum-Shub gets mentioned a lot by non-expert cryptographers. I suspect this is because it comes with a "proof" of security, which sounds like a wonderful ...

10

Blowfish has strong points regarding speed because bulk encryption (and decryption) reduce to an alternation of: a 8->32-bit table lookup, and one or two 32-bit operations (addition or XOR). That structure is very well suited to 32-bit CPUs with a short pipeline and a fast cache of at least 4 kByte; and is well suited for a straight C implementation, which ...

9

Not at all secure; generating preimages would be trivial. Here's a demonstration with a three-block message: Here is your suggested method (limited to three block messages): $E_0 = Encrypt( IV \oplus P_0 )$ $E_1 = Encrypt( E_0 \oplus P_1 )$ $E_2 = Encrypt( E_1 \oplus P_2 )$ $E_3 = Encrypt( E_2 \oplus 0 )$ $Hash = E_0 \oplus E_1 \oplus E_2 \oplus E_3$ ...

9

I'm just curious to know why the 128-bit version become the standard[.] That question is easy to respond. In the section Minimum Acceptability Requirements of Request for Candidate Algorithm Nominations for the AES, it says: The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-128, 192-128, and 256-128 ...

8

I can immediately think of four reasons: They're both not using AES256. I see in the Obj-C document a direct statement that they are using AES256 (unless you deliberately change it), I don't see any statement in the Visual Basic document that says what key size they're using (unless that's what they mean by "Block Bits"). Different keys. AES256 takes a ...

8

For symmetric algorithms (like AES or DES or RC4 -- but not for RSA or ECDSA), a key is a sequence of bits, such that any sequence of bits of the same size is a potential key. So longer keys means more possible keys. Exhaustive search is about trying all possible keys until a match is found. It is an absolute limit to the strength of an algorithm: ...

8

Because OCB is patented. And there are other good solutions for authenticated encryption that aren't patented. This makes them more suitable, in most situations. I can recommend, e.g., EAX, GCM, or CWC. EAX and GCM have been used in some standards, and AES-GCM has been standardized. For pointers where you can learn more, read Wikipedia. And try using ...

7

The paper explains why. Preventing the OS from interrupting the AES computation is part of Bernstein's proposed method of defense against cache-based timing attacks. Let me sketch the argument for you: The early part of the paper explains that if the time is variable, then it introduces a risk of timing attacks. Sections 3-6 demonstrate that such an ...

7

In this context 'security margin' is a measure for how much better we need to get at analyzing a cipher to break it. Such advances in cryptoanalysis require new ideas of how one might attack a cipher. Thus estimating how strong a cipher is, is hard. Ultimately we can only tell something is broken, after we've broken it. We typically look at a few ...

7

I'm taking the question as: given some cryptosystem using AES-128 with some random secret key $K$, what are benefits and drawbacks of computing and making public $\hat K=\operatorname{AES}_K(K)$? Benefit - $\hat K$ can be used as a KCV: A legitimate holder of $K$ could do the same calculation with the $K'$ he holds, and compare $\operatorname{AES}_{K'}(K')$ ...

7

A block cipher is an invertible transformation that maps an $n$ bit block of bits to an $n$ bit block of bits, under the control of a key (and where $n=128$ in the case of AES) Now, we most often need to do things other than mapping blocks of $n$ bits; how we do that is using the block cipher within a Mode of Operation. A mode of operation is just a way to ...

7

Decoy for whom? Security, and cryptography specifically, has a need for public scrutiny. It's been proven time and time again that hiding the nature of the protocol/algorithm/scheme doesn't provide any tangible security. Kerckhoffs' principle explains this: A cryptosystem should be secure even if everything about the system, except the key, is public ...

6

The capacity of AES in terms of file encryption is practically unlimited for the time being, especially in OFB or CTR mode. An 8 GB file comprises short of $2^{29}$ 128-bit AES blocks. If one uses CBC or OFB CFB mode, odds of a collision (that is, the same block appearing in ciphertext, which reveals 128 bit worth of potentially usable information about the ...

6

If you mean how much data can safely be encrypted by AES with a single key (and IV), AES is designed to encrypt up to $2^{64}$ blocks of data before becoming susceptible to certain statistical attacks (in particular distinguishing the encrypted file from truly random data), because of its 128-bit block size. 8GB (= $2^{36}$ bits = $2^{29}$ blocks) is quite ...

6

According to 7-Zip, Use ZipCrypto, if you want to get archive compatible with most of the ZIP archivers. AES-256 provides stronger encryption, but now AES-256 is supported only by 7-Zip, WinZip and some other ZIP archivers. So really there is some balance to be played with. Do you require better security at the sacrifice of compatibility or more ...

6

First let's take care of your encoding related issues: You can't simply say one byte equals one char. You need an encoding to transform between these, where the properties depend on that encoding. When transforming between normal text and bytes, UTF-8 is a good choice. One character will correspond to a variable amount of bytes that way. You'd use this to ...

6

No. AES-256 is not weaker than AES-128. Absolutely not. And I disagree with the the advice that you should avoid AES-256. The attack against AES-256 is a related-key attack, which is irrelevant to most real-world uses of AES-256. Related-key attacks only become relevant if you use the block cipher improperly, which is not something that you ought to be ...

6

AES by definition takes 16, 24 or 32 bytes as key, and nothing else. If you have a different size input use some kind of KDF to transform it to the correct length. If that input is a password this step is even more important. You should a key strengthening construction, such as PBKDF2 with sufficient iterations and a salt. If you use authenticated ...

6

I suppose that what you are trying to do is password-based encryption of some data; you use PBKDF2 to derive the password into an encryption key, and then use the key with AES to encrypt the data. The AES encryption needs an IV, and the PBKDF2 function needs a salt. Both IV and salt should be generated anew for each encryption (even if reusing the same ...

6

The 16-byte IV and ciphertext (which together are part of the output of $e_m$) are assumed to be intercepted by an adversary. That reveals the number $b$ of 16-byte blocks in the ciphertext. With CBC and PKCS#7 padding, $b=\big\lceil{{n+1}\over16}\big\rceil$ where $n$ is the byte size of the plaintext (the file size). Putting $n$ itself in a header thus ...

6

Of course it is technically possible to crack AES. The method for doing this is to guess the correct key. Assuming you know something about the plaintext, you can easily verify that the key you guessed resulted in the correct decryption. The probability of breaking AES using this method? AES has 128, 192 and 256 bit key variants. Thus if there are $n$ bits ...

6

The initialization vector is XORed against the first plaintext block before encryption in CBC mode, as shown in the Wikipedia article on block cipher modes. After the first block is decrypted, you still have an intermediate value which has been XORed with the plaintext — without this, you have little hope of recovering the plaintext. However, you do not need ...

6

If this is simply the AES permutation on a single block, it's hard to find such a pair. If it's AES-ECB with multiple blocks, you can pick each block from either (x1,y1) or (x2,y2), producing a new message that contains parts from each of them. With other modes it depends on that mode, but with many modes there will be a similar mixing attack as for ECB.

5

Well, how that matrix works is important for the security properties of AES. To see why it is important, we need to consider state differences, that is, if we consider two different inputs to AES and how they both flow through the cipher, how does those two differ in the internal state of the cipher at various places. The important property of the ...

5

I don't have my Real 802.11 Security book present, so my answer is based only on what I could glean from the CCMP and CCM page on Wikipedia. As stated there, CCM is only a mode of operation providing authenticated encryption (using CTR-mode for encryption and CBC-MAC for authentication), whereas CCMP is a protocol which utilizes the CCM-mode of operation. ...

5

TLS not only provides privacy, but also authentication: You can be sure you know who you speak to (at least the client knows if the server was using a certificate). (You provide this by the "HTTPS key exchange" you are doing at the start.) You can be sure that you speak to the same entity at the other side throughout the whole live of your connection (even ...

5

I think that a stream cipher would be the natural progression from a Vinegere, (before moving onto a block cypher). ARC4 would be my choice and there are good argument for that made by Arnold Reinhold over on http://ciphersaber.gurus.org/

5

The usual convention on attack cost is the following: "the cost is N" means that running the attack, with a success probability of at least 50%, requires no more than: N bits of memory space (RAM), N plaintext/ciphertext pairs, N*x clock cycles, where x is the number of clock cycles to compute one instance of the attacked algorithm (in the case of AES, ...

5

If you use a CSPRNG to generate the pad, you're not using a one-time-pad anymore by definition since the pad is no longer random, so the question as stated is incorrect with respect to terminology. The advantage of using stream ciphers is that you no longer have the key distribution problem the OTP has, since your key is now only a few dozen bits long, and ...

Only top voted, non community-wiki answers of a minimum length are eligible