Tag Info

Hot answers tagged

1

They're both broken under known plaintext attack, where attacker knows two (plaintext, ciphertext) pairs, $(m_1,c_1)$ and $(m_2,c_2)$: $E'_1(k_1,k_2) := k_1 \oplus E(k_2,m)$ $E'_1(k1,m_1) \oplus E'_1(k1,m_2)=E(k1,m_1) \oplus E(k1,m_2)$ The attacker simply computes $E(k1,m_1) \oplus E(k1,m_2)$ for every possible value of $k_1$ and compares it with $c_1 ...


1

To emphasize that this isn't a generically good construction, we can show that AES with that tweak method is insecure (!). This observation is based on a simple 1 round differential characteristic; it starts off with a differential in one of the bytes, and a carefully chosen differential in the tweak. With this initial differential, after the AddRoundKey ...


1

This construction isn't generically secure, you need to analyze it for each blockcipher you want to use it with to see if it's secure. For example, consider a block cipher that simply xors the key into the state between rounds. In that case your construction is equivalent to xoring the tweak into the key. This has several consequences: Since we generally ...



Only top voted, non community-wiki answers of a minimum length are eligible