New answers tagged

1

Since it's a bad habit to answer questions in comments, I'll take my comments, and put them as an answer. First off, you appear to be looking at designing your own homebrew method to do parallelizable MACing; don't do it. There are too many ways to get it wrong, and you don't know what to avoid. However, since you asked specific questions, I'll try to ...


1

You can check this answer which mentions how does the IV generated for GCM ciphers in TLS 1.2 ... is an AEAD Cipher, so it is in the form of GenericAEADCipher: struct { opaque nonce_explicit[SecurityParameters.record_iv_length]; aead-ciphered struct { opaque content[TLSCompressed.length]; }; } GenericAEADCipher; Here, the ...


1

The Siegenthaler result is for boolean functions, i.e., $f:F_2^n\rightarrow F_2$, while you are considering vectorial boolean functions $$f:F_2^n\rightarrow F_2^n$$ so you can't apply it. The results in this area are quite technical. Some overview: You could certainly compute resilience (hence correlation immmunity for AES Sbox) by using the definition ...


2

I understand that AES would be a better choice for applications where all the data is available at once, permitting the use of large blocks. RC4 on the other hand is more suited for applications where continuous data (that may not be available all at once) is to be encrypted (e.g., real-time data). No, this is not accurate. The block size of AES is just ...


3

This '.' is not 'AND' operation , its modular multiplication in the Galois Field $$GF(2^8)$$ and other operation $$\oplus$$ used in Mix Column Step of AES encrytion is modular addition in the Galois Field $$GF(2^8)$$. Here is a link to youtube channel by Christoff Paar where you can understand well, Watch lecture 7 and 8. Hope it helps.


1

AES S-box DDT is not uniform but it has a higher resistant to differential attacks than DES because of maximum probablity of input output pair of differential is 4/256.


7

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ where $\ell_a \oplus b$ represents the affine Boolean function defined by the bitvector $a$: $\ell_a(x) = a \cdot x$ ($\cdot$ is the dot product). The above ...


1

The answer "GCM is a good option as it combines encryption and integrity in one mechanism. " is a bit misleading. GCM uses one after another: 1-st encryption in counter mode and then GHASH to authenticate the data. In the recent intel processors CLMUL-NI is used to speed up the GHASH operations. Benefits of GCM over CBC+HMAC: is much faster, as the ...


1

I maintain the fastest implementation of pure Python aes It's reviewed in so far as it passes unit tests in __main__. Patches for more thorough testing are welcome. My fork of pythonaes made the decision that it's the crypto kernel to the point that it requires prepadded input


9

Is there any worthwhile way to authenticate the message using only these functions and simple checksums? As usual, of course there is: AES-CCM! AES-CCM basically is CTR mode with a tagged-on CBC-MAC and length prepending. You can implement CTR trivially using your ECB primitive and CBC-MAC shouldn't be too hard to implement given a CBC primitive and ...


3

Since any cipher must be able to decrypt every message that it encrypts, it follows that, given a fixed key, any cipher must be an injective function: In mathematics, an injective function or injection or one-to-one function is a function that preserves distinctness: it never maps distinct elements of its domain to the same element of its codomain. In ...


6

I was wondering about whether the usage of a precomputed sbox (kind of a lookup table) could be a serious security issue when using AES. Well, that rather depends on the type of side channel attacks you are interested in protected against. You specifically mention Power Analysis (SPA and DPA) type attacks; the first obvious question would be: could those ...


2

No, assuming AES is secure. That would be a known-plaintext attack.


5

The difference distribution table for the AES s-box contains mostly probability 2/256 differentials. However, there is a single probability 4/256 for each input/output difference. I uploaded a dump of the table here so that you can see. The code used to produce this table can be found here. Disclaimer: This is my personal github. If by "uniform", you mean ...


0

It isn't secure at all unless the GUIDs are completely inaccessible to everything except the encryption code. I doubt that is the case in a real application; I assume every DB query and API call passes those GUIDs around. Any anyone who can access the database can easily hash the GUIDs as well and decrypt any of the data. Your scheme as described is ...


4

ECB mode has several weaknesses as discussed in Why shouldn't I use ECB encryption? but in this specific case, it does not allow to gain information about the secret key AppKey involved. Indeed, encrypting the same block with the same AppKey will returns the same ciphertext. But in the LoRaWAN join-accept message, it does not matter because the server ...


5

If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey using the flaws in AES ECB? No. ECB is flawed, but not that flawed. At worst the attacker can know the encryption of a message if they have already seen the same ...


0

It is simply a parameter for indicating the length of the keystream in bits. Internally, EEA2 will call AES the appropriate number of times to produce that much output, truncating the last block as needed. It is not mixed into AES inputs or the key, so like you said it has no effect on the output bits themselves, beyond choosing how many are taken.


10

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a classical no-whitebox implementation on a different platform. The goal is that an attacker having access to the whole computation and intermediate values cannot ...



Top 50 recent answers are included