# Tag Info

10

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...

6

The point of the IV is to prevent the same (key,IV) from ever being used for two different messages in practice. This is an absolute requirement for stream ciphers or block cipher modes such as CTR that are effectively stream ciphers, because re-using the same (key,IV) pair lets an eavesdropper trivially obtain the XOR of two plaintext messages, which means ...

5

SHACAL-2 is a block cipher. One way compression functions are typically using block ciphers as a building block, but add some simple operation that make the function one way. In the case of SHA-256, the compression function is SHACAL-2 in Davies-Meyer mode. SHA-256 in turn, consists of this compression function with Merkle-Damgård padding and chaining. ...

5

Alternative 1, Interleave = ShiftRows Use a KDF for extending and splitting the input key into three keys $K_1, K_2, K_3$. Split the input into $A_0 = a_0..a_{15}, A_1 = a_{16}..a_{31},...,A_{16} = a_{240}..a_{255}$ AES-ECB encrypt using key $K_0$ so that $E_{K_0}(A_i) = B_i = b_{16i+0}..b_{16i+15}$ Interleave so that $c_{16i+j} = b_{16(i+j)+j \bmod 256}$ ...

4

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on randomly generated data of the kind it requires. If it can break some challenge (e.g. these), do it. Post the results to the challenger or show the results ...

4

You can get what you want programmatically. No special ciphers or modes needed. You say there is a single, continuous subset that needs to be encrypted. Thus, you could have a function where the programmer specifies the start of the portion of the plaintext that needs to be encrypted and the number of bytes to encrypt. The function could pull that part out, ...

3

Other advantages of CTR are: easier to decrypt from a certain offset within the ciphertext no randomness requirements for the nonce nonce can be calculated, e.g. be a simple counter nonce can be a message identifier $E = D$: encryption is the same as decryption, which means only encryption or decryption required from the block cipher less logic ...

3

There seems to be an attack on SSH when using CBC: Plaintext Recovery Attacks Against SSH. I have just scanned the paper and they state, that this will not be possible when CTR mode is used. I don't think that en-/decryption parallelization is need or even utilized in SSH. Update: Link to CERT concerning the topic: Vulnerability Note VU#958563 SSH CBC ...

3

If you can read the intermediate states of the encryption algorithm you could recover, one by one all the round keys. Given a AES round, all the operation between the two AddRoundKey (at the beginning and the ond of the round) are invertible. Take for example round 1: you get the internal state before AddRoundKey (of round 2), you get back at the beginning ...

2

There is book Algebraic Aspects of the Advanced Encryption Standard thats gives a good algebraic description of the AES algorithm. Reading it you'll see that there was some freedom in choosing some parametres to fix a standard. Changing this choices, but keeping the algebric properties should give you an equivalent algorithm. This mainly means you can ...

2

Assuming for the moment that your claim is correct, I would suggest caution in revealing the details of your findings. After having your results validated by one or two people with the skills to do so (and whom you trust to keep things confidential), then some sort of general announcement (without specifics) would be best, to give people time (say three ...

1

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The construction is only used in the v1.x of AEZ, because it requires appriximately 1.8 AES calls per block of plaintext, while the one used in v2.0 requires only 1 AES per block ...

1

Here are some advantages and disadvantages for each of the three classes of MACs, which I know about: Based on block cipher There are constructions where the security of the MAC is proven in terms of the security definition of a block cipher. This means as long as the block cipher is secure, the MAC will be secure. There are constructions where encryption ...

1

Unsurprisingly, any secure MACs are a secure choice. Assessing their relative security beyond how many bits of security they offer isn't possible in general. However, there are some differences that don't depend on the protocol: Unmodified CBC-MAC is only secure for fixed length messages, otherwise it allows some forgeries. Block cipher based MACs allow ...

Only top voted, non community-wiki answers of a minimum length are eligible