# Tag Info

17

People found MARS to be clunky and overly complex, leading to more effort for implementation and optimization, and also a less clear overall security picture. Assessments of "security" are, in fact, extremely subjective, because they rely on speculations about unknown future cryptanalytic attack, empiric traditions (e.g. "more rounds" = "more security"), ...

9

Yes, they can be described as a multivariate polynomial over $GF(2)$ (or over $GF(2^8)$). See algebraic cryptanalysis. This expression does not seem to help cryptanalyze AES, so far as we know, but it can be done. For an example of how to write AES in this way, see the following paper: A simple algebraic representation of Rijndael. Niels Ferguson, ...

9

At the time of the competition (I can talk about it, I was there), there was a lot of discussion and various people showed arguments. However, there was never an official, publicly known "board of scores" with totals and definite rules, as the pictures you show seem to purport. It is possible that the NIST people did make something similar internally, but ...

9

Yes, AFAIK the original TEA is safe and generally fine when keys are random (key change should be atomic and with a fresh random key); the 64-bit block size is not a concern (say, an operating mode other than ECB is used and the key is changed before a gigabyte worth of data); the relative slowness is not a show-stopper; side-channels are not an issue, or ...

8

Take $C_2$ and pick any $k_2$. Then decrypt using $k_2$ so that $M_2 = AES_{k_2}^{-1}(C_2)$. Now obviously we have $AES_{k_2}(M_2) = C_2 = C_1$. This extends to any blockcipher, because blockciphers are specifically designed to be reversible. In the comments you asked about the scenario where $M_2$ is also fixed. This is as hard as breaking AES. Consider ...

7

An Ideal Cipher with $k$-bit keys and a $b$-bit blocksize is a family of $2^k$ permutations on the set $\{0,1\}^b$ indexed by the set $\{0,1\}^k$, selected uniformly at random from the set of all such families of permutations. See e.g. http://eprint.iacr.org/2005/210.pdf. The IC model is primarily useful for proofs where you need to assume that the ...

7

CBC mode encryption is defined as: $C_i = E_k(P_i\oplus C_{i-1})$ (with $P_i$ being the $i$th plaintext block, and $C_{i-1}, C_i$ being the ciphertext blocks. What might happen if we have a lot of ciphertext encrypted with the same key is if two ciphertexts happen to be the same, that is: $C_i = C_j$ If we see that, we can then immediately deduce that: ...

6

When cryptographers create algorithms, they usually provide some argument that the algorithm is secure. They need to start the argument with some set of assumptions. For example, the in public-key cryptography, they may begin with the assumption that factoring large numbers is hard. Many algorithms use use a block cipher as a building block. The arguments ...

6

In their 2012 paper "The Security of Ciphertext Stealing", Phillip Rogaway, Mark Wooding and Haibin Zhang prove that all the NIST-approved ciphertext stealing modes provide the same level of security as ordinary CBC mode, i.e. ciphertext indistinguishability under a chosen-plaintext attack. To quote their abstract: "Abstract. We prove the security of ...

6

A block cipher is (or tries to be) a pseudorandom permutation on a given space. Let $\mathcal{M}$ be the set of $n$-bit blocks for a given $n$. There are $2^n$ possible block values, and a permutation on $\mathcal{M}$ sends each block value to another value. There are $2^n!$ such permutations. A block cipher is a mapping from key values (in a given key space ...

6

Did you try Wikipedia? DES consists of 16 rounds of the form: $$L_{i+1} = R_{i}, \quad R_{i+1} = L_i \oplus F(R_i, K_i),$$ which are identical except for the round subkeys $K_i$. (The last round is slightly different, in that the half-blocks $L$ and $R$ are not swapped as they are after all other rounds, but that makes no cryptanalytic difference.) The ...

6

There are many well known and studied ways of constructing a hash function from a block cipher. A thorough (but reasonably readable for a beginner) treatment of many of the classic approaches, and the security properties of the various constructions, can be found in Black-Box Analysis of the Block-Cipher-Based Hash-Function Constructions from PGV, which is ...

6

First of all, we need to review what they mean by "parity of a permutation"; they don't mean whether the input block had a even number of 1's. Instead, they view the $n$ bit cipher (with a specific key) as a permutation on $2^n$ objects; that is, it can be review as a way of rearranging that set of $2^n$ objects onto itself. Now, permutations on a finite ...

5

The exact information leaked depends on the mode of operation that is in use. The simplest case is ECB, where a duplicate ciphertext block means that the corresponding plaintext blocks are also equal. For the CBC mode, when two ciphertext block are equal, i.e. $C_i=C_j$, we know that there was equality before applying the block cipher. This in turn ...

5

A 6-byte nonce can expect to receive a collision 0.01% of the time after around 240,000 nonce generations (based on a birthday attack). After 100 such rotations (a little under 17 years, based on your 2-month rotation policy), that comes out to a likelihood of just under 1% of experiencing a collision. On the surface, to me that seems like a reasonable ...

5

No, the scheme described in the question does not provide integrity. A forgery is possible when the message's size is allowed to vary (which is presumably the case since some padding is used), and the adversary can choose some segment of the message with knowledge of the message before that segment. That is, a message $M=M_b||M_c||M_d$ with the beginning ...

5

Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in ...

5

A mode of operation is an explicit method by which we use a block cipher (eg AES) to do more than just encrypt one block of data. For example, it may allow us to encrypt multiple blocks of data (eg ECB,CBC etc), provide us with some authenticated encryption (eg GCM) or a method for encrypting disc storage (eg XTS). Rijndael,DES etc are block ciphers. That ...

5

Because CBC-MAC with inputs that are not prefix free is weak against existential forgery, meaning it is not a "secure" MAC. More precisely, CBC-MAC is easily distinguishable from a random function (i.e. not a PRF) when the input domain is not prefix-free. This is because an adversary can request the CBC-MAC of messages $M_0$ and $M_1$, and then xor the MAC ...

5

Actually, for CFB mode, the IV is the same size as the block size, 16 bytes. As for your question "does keeping the IV secret help security", the answer is "not really". CFB mode processes the message in blocks, and for each block of plaintext, combines that with the previous block of ciphertext to generate the next block of ciphertext. What the IV is ...

5

The tweak is generally not secret, i.e. the adversary knows it (perhaps even chooses it, depending on the attack model) and thus doesn't have to try to guess it. So no, tweaks don't increase the effort to brute force a cipher ... unless of course the tweak is kept secret, in which case it may or may not increase the required effort, depending on how the ...

5

By a generic attack we also understand an attack that with minimal corrections would apply to every block cipher. For example, suppose you have a (plaintext,ciphertext) pair and test keys by exhaustive search: you apply the keyed cipher $E_K$ to plaintext $P$ for every $K$ and check if you get ciphertext $C$ in response. Quite often, the ciphertext bits ...

5

Quite apart from the correction that Reid made (it takes $2^{127}$ attempts to achieve a probability of 50% of finding the right key; with $2^{64}$ attempts, the probability of success is $2^{-64}$), with AES, there is no known way to take advantage of known (or even chosen) plaintext to speed up any brute force search; even with $2^{64}$ chosen ...

5

It can't be achieved under the assumptions you are making, because the attacker can distinguish it by selecting an arbitrary $k'$, and checking if $E(k')$ commutes with the permutation in question. That is, to check a permutation $P$, we pick an arbitrary $x$, and check if: $E(k', P(x)) = P(E(k',x))$ This equation always holds if $P = E(k)$ for some value ...

5

Yes, we can build a hash function from a block cipher, and that's common, although with block ciphers designed for that purpose, when in the following I focus on AES, mentioned in the (different) question that motivated the present answer [which got moved here because said question was found to be a duplicate]. One classic method to obtain a hash function ...

4

From a quick read, there are a couple of potential issues. decrypt_128_256 is iterating rounds in the same order as in encrypt_128_256, so the round keys are being applied in the wrong order on decrypt. decrypt_128_256 needs to iterate through the round keys starting from the last round and working backwards. 68 rounds are being used for Speck128/256 ...

4

See minar's answer if you used ECB or CBC mode to encrypt (and CFB mode is similar to CBC mode -- if you find a colliding pair, you can deduce the relationship between two plaintext blocks). On the other hand, one of the things that Major Major ignores is that there are modes for which a duplicate block does not leak anything. Consider counter mode (CTR); ...

4

Your question is pretty confusingly written, but let me try to make some sense of it. You say you receive 8 bits of input every cycle. You want to encrypt the input using AES, which operates on 128 bits at a time. This means that you need to buffer the input somehow (a shift register might be handy here) for 128 / 8 = 16 clock cycles, until you've ...

4

A "cipher" is the algorithm which encrypts and decrypts data, while the "cipher-mode" defines how the cipher encrypts and decrypts it. In other words: ciphers are the cryptographic algorithms that you use to encrypt/decrypt data, while cipher-modes define the "mode of operation" for applying the cipher. Both are complementary and can be chosen separately. ...

4

If you applied a PRF directly to the message to obtain cipher-text, you would not have the guarantee that you could actually decrypt the message. Suppose the PRF maps $n$ bit inputs to some $m$ bit output. The mental model of a PRF is as follows. You have have a gnome in a black box. When you hand him a string from the input space, he flips a coin $m$ ...

Only top voted, non community-wiki answers of a minimum length are eligible