# Tag Info

## New answers tagged aes

1

KeyCzar is a cryptosystem on its own. It defines a container format, with a header, IV, ciphertext and possibly a (symmetric) signature. The keys it uses are also not just keys, they contain additional information. These "keys" may even contain multiple keys, i.e. an additional one for the signature creation. To decrypt KeyCzar encrypted files you need a ...

2

CCM mode uses CTR mode the encryption and CBC-MAC for the authentication. For a security proof you can refer to On the Security of CTR + CBC-MAC. With CTR the fact that AES is a PRP rather than PRF starts to show after $2^{64}$ blocks have been encrypted. In practice this does not lead to a very effective attack even then. After a similar number of blocks ...

6

If your software needs to decrypt the data and you want to prevent even those with physical access from decrypting without your software, you are basically out of luck. It is impossible to achieve purely in software, since even if a good white-box algorithm existed, an attacker could copy it into their software and be able to decrypt (without directly ...

5

What you are looking for is called white-box cryptography. In short white-box crypto aims to make an implementation of a cypher (for example AES) in such a way that it is impossible for an attacker to extract the key, even if the attacker (the user of the computer) has access to the source code and a debugger. Up till now all academic white-box ...

1

This is called steganography and while the example you give is not significantly better than just having the AES in a "text file" (because it would not look like an actual PNG file), there are algorithms for hiding information in a "cover" file. However, if you do not mean to hide the fact that you have encrypted something, using AES alone is normally ...

1

"Hiding" content in an image (or other medium, it's a general technique called steganography) can be done either in a very obvious way (a dedicated data block, called ancillary chunk, which does not form part of the image), or it can be more effectively hidden in the low order bits of the image, thus very subtly degrading the picture. Both methods can be ...

0

What your are describing is the typical use for public key cryptography. It is usually refereed to as KEM/DEM or Hybrid Paradigm. KEM/DEM stays for Key Encapsulation Method, Data Encapsulation Method. To encrypt a file one draw a random secret ket to be used with AES, he draws also a random IV and a nonce and potentially an AAD. He use this data to encrypt ...

0

Typically things would go like this: A generates a random AES key and encrypts it with the public key. A encrypts the file contents using AES GCM and that key. Nonce can be random or even zero if the key is only used once. AAD can be empty unless something else needs to be authenticated with the file. A sends over the encrypted key, the nonce if any, and ...

1

If I'm understanding your question right, you're asking "How to brute-force the Bitlocker encryption without being able to install stuff and without using "backdoors" and without having the key-file (if used)?" You can't brute-force AES-128 without the said key-file. The reason for this is that the key file contains the 128-bit keys which are too hard to ...

0

The other answer's suggestion of encrypting the file-encryption key twice is good, so I will only answer the part about backup key size. Now while using a 53bit key as a backup key may seem as a crypto joke, when we actually consider that an average password would be [...] If you go with the average password complexity, those users who do choose a ...

1

This kind of key management problem is a big reason why encryption is not more widely used for everyday data. I see a single easy way to do this, I think it is similar to the way disk encryption systems work, and it may not work for your uses. For each file, a random key $kf$ is generated. 2 copies of the key are encrypted, one with a key derived from the ...

1

Now I would like to use a single-block AES128 for the HMAC calculation in this scheme [...] HMAC requires a hash function with a variable input size, so you cannot just use AES in it. If you want to use some other MAC instead of HMAC, you can use AES. AES ECB is a secure MAC for single block messages, so that would work. Given this answer to a ...

3

If we assume that AES is a pseudorandom permutation (which is a standard model for block ciphers), then AES can replace the HMAC in your construction. Be aware, this only works because you have a fixed message length, i.e. the protocol must not accept nonces $> 128$bit. Besides, I guess you are aware of this but you have a shared secret key among all ...

4

What you are asking is a straight application of Format Preserving Encryption, which builds ciphers which input and output are in a constrained format (generically: common to input and output, hence preserved). The FPE field has many articles with proven techniques; and proposed standards, including BPS and SP800-38G Draft. Note: the method tentatively ...

0

Because XTS already solves the problem ESSIV is designed to solve. Disk encryption modes are meant for retaining some security despite the lack of space for a unique IV. They do this by making use of the sector number so that at least multiple copies of the same data stored in different places end up looking different. That is not sufficient for good ...

3

Verilog is Turing complete, so you can implement any algorithm in Verilog, if you really want to.

0

If you encrypt the private say with a 8-char password, the strength of your solution will be not 32 bytes (256 bits), but merely 8 bytes (32 bits). The comment of "user4982" above is correct. Doing your encryption process more complicated does NOT make it more secure. The strength depends only on the length of the secret. In your case it will be the ...

2

It’s tested against many of the test-vectors (key varying, plaintext varying, Monte Carlo), which is the only contract it needs to fulfil... I've got some speed/timing information now: 128 bit, key setup 0.37ms 128 bit, ECB, encryption 0.58ms / block (27.5kB/s) 128 bit, ECB, decryption 0.77ms / block (20.5kB/s) 192 bit, key setup 0.41ms 192 bit, ECB, ...

6

SIV is a mode specially designed for this purpose. SIV-AES would be a good choice, but it has the same issues as AES-wrap; not many implementations. If you use a GCM you should make sure that the IV is unique (if your plaintext is ever not random you would otherwise be in problems). As for the password based key derivation function: yes, PBKDF2 is good, ...

5

An important principle in cryptography is "key separation" which holds that one should "use distinct keys for distinct algorithms and distinct modes of operation". Violating key separation often opens up avenues of attacks that may break confidentiality, integrity, or even recover the key. You can use a KDF to derive cryptographically independent keys from ...

1

Yes it is a normal matrix multiplication but within Galois finite field. We have to use Galois defined operations of $+$ and $\cdot$. Example might clarify everything. Let's say we have the $b'$ vector, and it's value is $170 = 10101010b$ Just remember tat $b'_0$ is the least significant bit of that value. \$b_0 = (1 \wedge b'_0) \oplus (0 \wedge b'_1) ...

0

This is normal matrix multiplication, but when filling in b′ remember that b′0 is the least significant bit (this is the case for the answer too). The matrix multiplication and addition will result in numbers other than 0 and 1, but using the modular 2 it will reduce to 0 and 1 only.

4

For encryption or decryption of data that is encrypted on the fly, you can do that. For data you store you obviously have to use the same decryption, so if you encrypt a huge file using AES, you have to decrypt it using AES, even when on battery power. First thing: If there is hardware support for AES, AES will be faster and using less power almost certain. ...

3

The best solution depends on the details of your application, but I have one comment and one suggestion. First the comment: You say you have AES hardware available. I don't know the details of your platform, but this hardware is likely to be much more efficient in time/power than a software implementation of any reasonable encryption algorithm. You need ...

3

As you said you are OK with a little bit less security in the more performant algorithm, I suggest Speck for that. It was developed by the NSA, so although some might worry about a backdoor (I personally doubt there is one though I would not know the difference if there were), it probably also means that ordinary people will not break it easily if at all. ...

7

Yes, AES-128 is intended to be the standard block cipher for building a secure and efficient symmetric cryptosystem using some block cipher operating mode, like CTR for encryption or GCM for authenticated encryption; efficiency can be particularly good when there is hardware support for AES and GCM. There might be better choices in the case at hand, like ...

2

The RAR5 archive format encrypts file data using AES in CBC mode, and generates a 256-bit key using PBDKF2-HMAC-SHA256 (32768 iterations default?). If an attacker is able to view many files encrypted this way all with the same key, the attack is to recover the key from the ciphertext. This is not an easy task, even if the IV was reused. In WinRAR, the IV ...

3

You don't actually need 384 bits of key material. The IV for GCM does not need to be secret, and may be chosen deterministically, e.g. as an incremental counter. Thus, you only need 256 bits for the AES key, which you already have. That said, if you did actually need more key material, you could use any standard KDF to expand your 256 bits. Since you ...

1

Modern computers are quite fast, and modern cryptographic algorithms are quite efficient. Most computers benchmark hardware accelerated AES in CTR mode well above 1GB/s, which would be a fraction of a millisecond for a 100KiB file. Since the standard system timer generally runs at 1ms intervals, the entire encryption operation ([file data] XOR [AES] XOR ...

Top 50 recent answers are included