New answers tagged

3

All of the mathematical operations within the s-boxes, shift row, and mix column should be known to the attacker, correct? Yes, see Kerckhoff's principle I understand they could be hard to calculate but aren't they static operations for the most part? I'm interpreting "static operations" to mean subBytes + shiftRows + mixColumns + addRoundKey, and that ...


4

The XOR state is irreversible without the proper key which is what I understand, so whats the point of all of the other operations that happen on the key? Suppose all we had was secret keys and the XOR operation. Well, actually, it is possible to build a secure cipher out of that, called the one time pad. One time pads offer perfect secrecy, but suffer ...


7

This is identical with CTR mode encryption with a MAC. That's known to be secure. It doesn't say in your question if: the Ai blocks are completely unique; the header is included in the MIC calculation. If those preconditions are met then I don't see any issue with the protocol. The first one I cannot verify but seems likely, the second one is certainly ...


5

Any of the ways you listed would work. If you're collecting alternatives, yet another one (which I have seen in practice) is to include the message counter as the AAD (additional authenticated data), which is another input to GCM. When we consider which one would be the best, we note that GCM has absolutely no requirement that the nonce be "random", or for ...


4

As indicated, the header format of your proprietary encryption is entirely up to you. Still, as I see this forgotten or done imperfectly a lot of times, I'll give some general hints in the right direction. First of all, complexity is the enemy of security. If you make your header overly complex you may get into trouble. It could be possible to generate ...


1

Here is an example encoder / decoder of pairwise IDs that we use in OpenID Connect, based on AES/CBC/PKCS5Padding encryption.


0

Any full rank $n \times n$ circulant matrix $A$ with all entries nonzero generates an MDS code. The entries here were picked for efficient fast multiplication, as far as I can recall. Do refer to the book suggested by @SEJPM for more.


2

TL;DR: Chances are there are no attacks against this scheme. What you are describing sounds exactly like a chosen-plaintext attack, e.g. you can query an oracle to encrypt plaintexts of your choice (using the oracle's random IVs). Now, this attack is already stopped by AES-CBC which is provably immune to this sort of attack. And furthermore it seems like ...


6

Can exponent be random number just like it is now or it should be a prime too? There is no particular advantage to be gained in selecting only prime exponents. Is using dynamic modulus and generator better idea? Whether it makes sense to use dynamic modulii is currently under debate. There are known algorithms that make attacking multiple discrete ...


2

"I'm using [AES] in CBC mode, but the implementation doesn't add the randomness I want, the same message when encrypted looks the same." This is a problem. If you were using CBC mode correctly (i.e. with a random IV), then encrypting the same message twice would produce completely different ciphertext. Since you're not using CBC mode in the way it's ...


0

The technique called "Angecryption" might be relevant to you. It allows you to encrypt a known plaintext to a given ciphertext under a given key. However, I'm not sure what file types it supports, and if the types supported are relevant to you. The example in the article is turns a picture of annakin skywalker into darth vader given the key "Anger = ...


2

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight 128-bit AES blocks in parallel, using eight 128-bit XMM registers to store them. They're not doing basic "naïve bitslicing", which would involve using 128 $n$-...


0

It all depends on your restriction of length of initial password. If your user is able to enter password of just 4 characters, then doing SHA1 etc is not going to add any entropy (in simple words the brute force space for the attacker is not going to increase). Assuming attacker can check One million password per second then below is a summary for your ...


3

No, this is not a terrible idea, this is an idea that is often used. Basically you've described the main use of a symmetric block cipher for exactly the block size of AES. AES is fully deterministic and not reversible without the key. A block cipher is a Pseudo Random Permutation (PRP) - basically a map - from a set of all possible plaintext to a pseudo-...


1

The Encryption is not likely Compression where one can choose Normal, High or Low or something from scale of 0-100 as you mentioned. If you really want to do it, you can think of it in two ways Reduce the keyspace, as already mentioned in an above answer Reduce the Rounds. But these both will lead to a situation where you may end up in a breakthrough (...


4

The simple answer is "Because its an SPN cipher". What is difference between Feistel and SPN? SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then operate upon X parts where 0 In balanced, data is divided in Two parts i.e N = 2, and X=1 (example is camellia cipher) In Unbalanced, data is divided in more ...


-1

AES does not use Feistel structure. Instead, each full round consists of four separate function: byte substitution, permutation, arithmetic operations over a finite field, and XOR with a key. From cryptography and network security principles and practices 5th edition Chapter 5 page 148


1

Unlike others I don't think that cracking AES is that unlikely - but then I have a rather strict definition of the semantic security of encryption algorithms... The following scenario seems most likely to me (and resembles for example how WEP was cracked). Note first, that a single cyphertext will produce several valid WPA2 packets when decrypted with ...


16

If you "crack the AES", a very hypothetical assumption, then you could simply parse the WiFi packets and decrypt the messages that are being send. Cracking AES is however considered impossible. AES-256 is even considered secure against attacks that involve (somewhat less hypothetical but still unavailable) quantum computers. Note that even RC4, which was ...


0

Khazad has an $8\times 8$ MDS matrix $A$ used as the diffusion layer. The augmented matrix $[I|A]$ generates a $[n,k,d]=[16,8,9]$ MDS code over $GF(2^8).$ The implications are: The minimum number of active Sboxes, i.e., the minimum branch number across 2 rounds is $9,$ the minimum weight of the MDS code. MDS codes have a fully known weight distribution, so ...


0

I made a toy cipher that functioned in this manner. It had a bytewise transposition step that was performed by an invertible randomized permutation, similar to the Fisher-Yates shuffle, but easily invertible. Key material was used to select the next "random" index to shuffle, so as to enable decryption. At first, I really liked the idea, figuring that ...


3

Short answer: Not enough. The AES algorithm is defined in the FIPS standard with keylenght of 128, 192 or 256 bits. So you cannot use directly a 56-bit key. One needs to have a key with the proper length to use the AES encryption algorithm. Data will be protected using AES-256 encryption with a 56-bit effective key length probably means that the key ...


3

If the effective key length is 56-bit, that means you have to enumerate only 56-bit. It's not secure at all. From Wikipedia: In February 1997, RSA Data Security ran a brute force competition with a $10,000 prize to demonstrate the weakness of 56-bit encryption; the contest was won four months later. In July 1998, a successful brute-force attack was ...


8

It would appear that this is as a consequence of the Wassenaar Arrangement (more detailed explanation). Basically, because cryptography falls under certain laws regarding munitions and arms trafficking there are restrictions on the strength of the cryptography you are allowed to sell (if the product is not a mass market product). It would appear that the ...


0

AES ShiftRows operations ensures that each new column contains one byte from one of the 4 old columns. Thus it achieves Full diffusion in 2 rounds. You are right that there could have been other arrangement / shuffle of bytes to meet this criteria too. But if we analyze AES design, we will find that speed and memory requirement on all types of platforms ...


11

In general the AAD itself is not required or won't change the security of the GCM mode of operation itself. It may however directly influence the security of the protocol in which GCM is deployed. For instance, you may have specific configurable parameters outside the ciphertext itself. These parameters may very well include: version number of the ...


8

AAD has nothing to do with making it "more secure". The aim of AAD is to attach information to the ciphertext that is not encrypted, but is bound to the ciphertext in the sense that it cannot be changed or separated. (Conceptually, the MAC is computed over the AAD and the ciphertext together.)


0

The image below shows the 30 irreducible polynomials for GF2^8. As an interesting factor it seems that 16 out of 30 has Hamming Weight of 4 (ignoring the MSB i.e x^8) and more interestingly 7 out of these 16 (with Hamming Weight 4) has nibble wise balanced Hamming Weight. Twofish m(x) is on of the nibble wise balanced. One more beauty you will find in it ...


6

Coincidentally I had the Twofish and Camellia design papers open on my computer when you asked this question. S-boxes in the ciphers Both are Feistel ciphers, and the way the s-boxes are used is quite different when compared to AES. The s-boxes are used almost identically in Twofish and Camellia, but key mixing and post s-box diffusion are quite different. ...


5

Yes, if your ciphertext is repetitive, that's bad. We can't really say how bad, since you haven't told us enough about your cryptosystem. It could be because you're using AES in ECB mode, which is kind of bad. Or it could be e.g. because you're using AES in CTR mode with a fixed IV, which would be worse. Or, in principle, you might be using a ...



Top 50 recent answers are included