Hot answers tagged block-cipher
29
There are a variety of reasons why AES is more widely used:
AES is a standard.
AES has been vetted by cryptanalysts more extensively than Camellia. As a result, we can have greater confidence in the security of AES than in Camellia. Therefore, on the merits, there may be good reasons to choose AES over Camellia.
AES is a government standard (FIPS). ...
29
The initial and final permutation have no influence on security (they are unkeyed and can be undone by anybody). The usual explanation is that they make implementation easier in some contexts, namely a hardware circuit which receives data over a 8-bit bus: it can accumulate the bits into eight shift registers, which is more efficient (in terms of circuit ...
26
For practical purposes, 128-bit keys are sufficient to ensure security. The larger key sizes exist mostly to satisfy some US military regulations which call for the existence of several distinct "security levels", regardless of whether breaking the lowest level is already far beyond existing technology.
The larger key sizes imply some CPU overhead (+20% for ...
18
The really simple explanation for the difference between the two is this:
ECB (electronic code book) is basically raw cipher. For each block of input, you encrypt the block and get some output. The problem with this transform is that any resident properties of the plaintext might well show up in the ciphertext – possibly not as clearly – that's what blocks ...
14
Applied Cryptography is book which is becoming, say, not-so-recent. NSA has quite a lot of budget, but not an infinite amount, and there are other organization, in particular big private corporation, which also have impressive means. Google or Apple, for instance, are companies with R&D activity in the area of cryptography, and who are able to ...
14
As a bonus feature, AES has hardware support in Intel processors which implement the AES instruction set, with AMD support coming soon in their Bulldozer based processors.
The AES instructions set consists of six instructions.
Four instructions, namely AESENC, AESENCLAST, AESDEC, AESDECLAST, are
provided for data encryption and decryption (the ...
14
Assume that 1 evaluation of {DES, AES} takes 10 operations, and we can perform $10^{15}$ operations per second. Trivially, that means we can evaluate $10^{14}$, or about $2^{46.5}$ {DES, AES} encryptions per second. This is a simplistic view: we are ignoring here the cost of testing whether we found the correct key, and the key schedule cost.
So on our ...
13
Basically it's analysis of a cryptographic cypher by the means of finding a relationship between the difference in the input data and the output data.
Ideally, the slightest difference in input data (cleartext), even a single bit, should produce a completely different cypthertext. However, if the cypher is not well-designed, a correlation between the two ...
13
A known-plaintext attack (i.e. knowing a pair of corresponding plaintext and ciphertext) always allows a brute-force attack on a cipher:
Simply try all keys, decrypt the ciphertext and see if it matches the plaintext.
This always works for every cipher, and will give you the matching key. (For very short plaintext-ciphertext pairs, you might get multiple ...
12
What you're looking for can be done using existing schemes for format preserving encryption (FPE). In general, FPE schemes convert an existing strong algorithm like AES into a block cipher that operates on a set of any size. For instance, FPE can encrypt 15 digit integers to other 15 digit integers (eg for credit card numbers, one of the common reasons for ...
11
The actual encryption algorithm is almost the same between all variants of AES. They all take a 128-bit block and apply a sequence of identical "rounds", each of which consists of some linear and non-linear shuffling steps. Between the rounds, a round key is applied (by XOR), also before the first and after the last round.
The differences are:
The longer ...
11
Short version: It is quite likely that a large proportion of the keys have fixed points, but I don't have any idea on how to find them.
Long version: A stochastic argument
There are $2^{128}!$ permuations of 128-bit blocks, and of these, $!2^{128}$ (this is the subfactorial) are fixpoint-free. It is known that
$\lim_{N\to\infty}\frac{!N}{N!} = \frac 1e ...
10
Let a "block cipher" be defined with a fixed S-box $S$ (i.e. a permutation of some space) and a key $K$ (same size than a block), such that the encryption of a block $M$ is $C = S[P\oplus K]$. Everybody knows $S$ and can apply and invert it (that's a "S-box", not a "key" -- if the S-box is "key dependent" then the S-box is itself a block cipher in its own ...
10
Well, to start off with, IVs have different security properties than keys. With keys (as you are well aware), you need to hide them from anyone in the middle; if someone did learn your keys, then he could read all your traffic.
IVs are not like this; instead, we don't mind if someone in the middle learns what the IV is; as long as he doesn't know the key, ...
9
This approach, at a high level, is actually fairly common; many stream ciphers operate on this very principle. For instance, Salsa20 uses what is effectively a hash function (a PRF) to convert a secret input (that includes a counter) into the keystream which is XORed with the plaintext. However, this kind of function can be much faster than a secure ...
9
Having taken The Design of Rijndael from the library just yesterday, I had a look on this problem, too. Fixee wrote in a comment:
However, my question is not so much about security implications, but rather
"how does omissions of MixColumns make the inverse cipher similar to the cipher?"
and "how does this help in implementing the cipher?"
The ...
9
Well, as far as we know, the mode you suggest should be secure. Now, to be honest, AES256 versus your mode isn't quite a fair comparison; your mode gives somewhat less theoretical security; if you encrypt a known $2^n$ block message, the key can be recovered with $2^{256-n}$ effort; however, this observation doesn't really affect the practical security.
...
9
I'm just curious to know why the 128-bit version become the standard[.]
That question is easy to respond. In the section Minimum Acceptability Requirements of Request for Candidate Algorithm Nominations for the AES, it says:
The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-128, 192-128, and 256-128 ...
9
Within the DES block cipher itself, the XOR operation is used at two different places:
On the input of S-boxes, XOR-ing 48 bits per round: 48 bits from a subkey (extracted from the 56-bit key), and 48 bits that are the output of expansion E. The 48-bit result forms the eight 6-bit inputs of the S-boxes.
On the output of S-boxes, XOR-ing 32 bits per round: ...
9
The reason why you see that is because Camellia is the highest-preference cipher in NSS (Chrome and Firefox). Servers that support Camellia and use the client-preferred cipher suite will use Camellia.
NSS's rationale for this ordering is:
National ciphers such as Camellia are listed before international
ciphers such as AES and RC4 to allow servers ...
8
It depends on the chaining mode. With recent modes like EAX and GCM, the IV just needs to be non-repeating, so a timestamp is OK (as long as you take care never to issue two messages with the same timestamp: this can be a problem if you emit two messages in, say, the same millisecond, or if the sender clock is somehow reset through manual action or NTP; ...
8
Well, the exact reason for an IV varies a bit between different modes that use IV. At a high level, what the IV does is act as a randomizer, so that each encrypted message appears to be encrypted to a random pattern, even if those messages are similar. In general, IVs disguise when you encrypt the same message twice (and more generally, when two messages ...
8
The AES standard is reasonably clear, and (theoretically) sufficient to implement the AES itself. For block cipher modes of operation (including counter mode), see NIST Special Publication 800-38A.
8
If you look closely at the definition of authenticated encryption modes, you will see they all are, actually, the combination of symmetric encryption and a MAC.
Using traditional encryption and an independent MAC has a few tricky points, none of them being unsolvable:
The encryption mode will use a key, and the MAC will also use a key; using the same key ...
8
First of all, avalanche effect is a desirable effect: it means that a very small change in the inpout will lead to a very big change in the output. A security algorithm that doesn't provide this avalanche effect can lead to an easy statistical analysis: if the change of one bit from the input leads to the change of only one bit of the output, then it's easy ...
8
Padding None can be used with stream cyphers and AES-CTR in order to keep the cyphertext the same length as the plaintext. Padding Zeros cannot always be reliably removed, and so should be avoided. Any of the others can be reliably removed and are fine for use.
Padding None leaks information about the length of the plaintext. Apart from that there is no ...
8
Well, it sounds like you're close.
The multiplications implicit within the MixColumns operation are $GF(2^8)$ multiplication operations, using the same field representation as they use in the inverse within the sbox.
However, because they're multiplying by the fixed constants $\mathtt{1}$, $\mathtt{2}$ and $\mathtt{3}$, it's easier to implement than a ...
8
If a block cipher is linear with respect to some field, then, given a few known plaintext-ciphertext pairs, it is possible to recover the key using a simple Gaussian elimination. This clearly contradicts the security properties one expects from a secure block cipher.
8
If you look at the CBC diagram, you'll see that having a fixed IV is equivalent to having the first ciphertext block become the IV. If your cipher is a good pseudorandom permutation, then what you are doing does work, if and only if all timestamps are unique such that the "new IV" is unique and unpredictable.
And in fact, if you do not use the ...
7
ECB and CBC are only about encryption. Most situations which call for encryption also need, at some point, integrity checks (ignoring the threat of active attackers is a common mistake). There are combined modes which do encryption and integrity simultaneously; see EAX and GCM (see also OCB, but this one has a few lingering patent issues).
Only top voted, non community-wiki answers of a minimum length are eligible
