# Tag Info

7

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message. This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the corresponding ciphertext $(C_1, C_2, ..., C_n, T)$ (using some IV; we don't care what it is). Here is how the attacker can generate a ciphertext that would ...

2

Assuming $f^{-1}$ exists (i.e., that $f$ is injective), then $$f_k^{-1}(y) = f^{-1}(y \oplus k) \oplus k.$$ To see why consider an $x \in \{0,1\}^4$ so that $f_k(x) = y$. Then you have that $$y \oplus k = f (x \oplus k).$$ Now by applying $f^{-1}$ on both sides of that equation you have $$f^{-1}(y \oplus k) = x \oplus k.$$ And finally by XOR'ing $k$ on both ...

2

I understand that if a block cipher has $k$-bit keys and $n$-bit input/output blocks, then if $k>n$, we can expect one message-ciphertext pair to narrow us down (I think?) to $2^{k−n}$ possible keys, right? That is approximately correct (if the block cipher with the wrong key acts like a random permutation; this is generally a safe assumption); if ...

1

I believe that, in this specific case, you are correct; it would appear to take $2^{60}$ effort to find a collision in the above function. On the other hand, there is one nit with this approach: this makes stronger assumptions on the block cipher than is typically assumed. A block cipher behaves as a random permutation if it is keyed by a random unknown ...

1

You're missing a component : a padding convention. Yes, if you're trying to reduce a block size, it will reduce the cipher strength. That's why the less-sized blocks are padded/filled to fit the exact size. What to do : pad or fill or both - that is a question. First you need to understand, that the more predictible the message, the less secure the ...

1

Rijndael-128, Rijndael-192 and Rijndael-256 are actually 3 different variants of block cipher that are very similar. Simon, Speck, Threefish and RC5 also define different block size variants in similar way. Rijndael is not unique in this regard. Block cipher that really has variable block length is XXTEA as its block length is not limited.

Only top voted, non community-wiki answers of a minimum length are eligible