# Tag Info

4

If you applied a PRF directly to the message to obtain cipher-text, you would not have the guarantee that you could actually decrypt the message. Suppose the PRF maps $n$ bit inputs to some $m$ bit output. The mental model of a PRF is as follows. You have have a gnome in a black box. When you hand him a string from the input space, he flips a coin $m$ ...

2

What the specification is saying is that prior to processing, the message is padded to a full block length, with the empty message padded to a single block. The spec on page 4 describes the input into the algorithm as: Define $||a||_n = max\{1, \lceil|a|/n\rceil \}$, where the empty string counts as one block Let $m = ||M||_n$ Partition $M$ into $M[1] ... ... 1 AES-128 uses the full set$\{0, 1\}^{128}$as keyspace, and for each key the blockcipher is defined for each input block in$\{0, 1\}^{128}$. The same goes for AES-256, but it uses a 256-bit keyspace (but still a 128-bit block). So the answer to 1 is yes. For 2, we have this equation: $$AES_K(AES_K^{-1}(x)) = x$$ We can decrypt both sides: ... 1 Very few cryptosystems actually use a block cipher directly (i.e. in "ECB mode") to encrypt data — and those that do usually only do so because whoever designed them didn't really understand how a block cipher should be used. Rather, the main use of block ciphers in cryptography is as versatile building blocks for other cryptographic components, such ... 1 I'm still a little unsure what your question is, but I'll try and answer what I think you're asking. If it isn't, please clarify your question or comment below. Let us assume that$E_k$is an ideal block cipher$^{[1]}$, and so acts like a random permutation of$2^{64}$elements. Given$(m,c)\in M\times C$find$k\in K$such that$E(m,k)=c\$. How long ...

Only top voted, non community-wiki answers of a minimum length are eligible