# Tag Info

2

Aren't $IV_1$ and $IV_2$ public in TLS 1.2 as well? $IV_1$ certainly is (as that's just the ciphertext block in front of the block we're attacking); however the IV that the TLS 1.2 sender will use for the next message ($IV_2$) is not. In fact, the sender might not know it yet, as it might not have not picked it yet. But doesn't this mean that BEAST ...

3

In your example, $Encryption_1$ is $\textsf{AES}_{CTR}$ and $Encryption_2$ is $\textsf{Salsa20}$. Then, the encryption method you are proposing is $Encryption_1(Encryption_2(plaintext))$, which is in fact a cascade of stream ciphers. Note that, because you simply XOR the streams, this cascade cipher commutes, that is, you will have the same result if you use ...

-1

Yes, your analysis is right. Don't know why Maarten Bodewes - owlstead says something else. This doesn't mean that your scheme is secure or the best idea. Every plaintext block will be encrypted with a new, pseudo random key. If the bit generation of the stream cipher is secure then there's no known way to get the original password without brute forcing it. ...

3

Asmuth and Blakley provided a proof that, assuming the keys for each cryptosystem are chosen independently, breaking their composite cryptosystem is at least as hard as breaking the hardest part of either. [1] Building on their work, cascade ciphers have been shown to in fact be harder to break than the hardest part of either. Admittedly, what you're ...

3

Under your scheme, the keystream generated by the stream cipher will be the same for each message enciphered with the same key. While your scheme does not encrypt identical blocks of plaintext in the same message to the same value, it does encrypt identical blocks of plaintext in different messages to the same value, meaning that XORing two ciphertexts ...

8

The modern trend for encryption-only modes is clearly CTR, which has a number of advantages over other modes: no padding is needed (contrary to CBC); the computationally-intensive part can be efficiently performed with the IV (and key) only, before the plaintext or ciphertext is available (contrary to CBC, CFB); the computationally-intensive part can be ...

1

For question (1): This page gives some hints on IVs and CBC: https://defuse.ca/cbcmodeiv.htm I copy-paste the part about IVs "predictability" Chosen-Plaintext Attacks Randomness is not enough, though. IVs have to be unpredictable, too[2]. Suppose there is a CBC-mode encryption system that selects a random IV, publishes it, asks the user ...

1

You say are asking as a learning exercise, to learn how to invent ciphers. The way to learn that is not to try to invent some block cipher and then ask others to break it. The way to learn is to learn cryptanalysis, by breaking other ciphers. See Schneier's self-study course on cryptanalysis for one good resource.

3

When seeing clearly through all the cube "magic", one recognizes the following: All the cube operations are just key-dependent bit permutations. Therefore, the whole cipher is a sequence of key-dependent permutations and XORs with key bits. This admits an algebraic description: For all keys, there is a permutation matrix $A\in\mathbb F_2^{512\times512}$ and ...

2

Your scheme is indeed an instance of output feedback mode (OFB), using $$(\mathit{key},\mathit{pad}) \mapsto H(\mathit{key}\oplus\mathit{pad})\text,$$ where $\mathit{key}$ corresponds to keyhash and $\mathit{pad}$ to hash, as the "block cipher". (It is very likely not really a block cipher due to lack of bijectivity, but that's not needed for output feedback ...

0

You are creating a bitstream and XORing it with your plaintext so yes, it is. More precisely, it's a block cipher. Have a look at a previous discussion.

3

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible MAC constructions: They carry along some state that incorporates information from the message while traversing the input blocks. In both modes, encrypting a block ...

4

Usually cryptographic strength is given as the effective strength in bits of a security primitive. This is related to the amount of tries necessary to break a primitive. So for AES-128 the effective strength is about 126 bits. The number of bits is of course directly related to the number of tries required to perform an attack. This is often given as a power ...

4

If you mean DES as block cipher without mode of operation then no, this is impossible. DES is a block cipher, and block ciphers are Pseudorandom Permutations (PRP). As permutations in turn are bijective functions of $\{0,1\}^n$ to $\{0,1\}^n$ there is always a one to one relationship between plaintext and ciphertext. If this wasn't the case then you would ...

6

No, that is impossible. The reason is simple: How would you decrypt this? If you input the ciphertext and the key into the decryption function, than you have to get exactly one output, not two. How would you decide which output is the correct one? The DES encryption and decryption functions are bijective under one given key. This means that for every ...

1

To simulate $n$ times iterated ECB encryption, you can set your input plaintext block as the IV, encrypt a "plaintext" consisting of $n$ all-zero blocks using either CBC or CFB mode (which are identical for all-zero plaintext), and take the $n$-th block of the resulting ciphertext (discarding the rest of the output). Note that, if your CBC mode ...

2

First lets acknowledge this is a horrible hack - you really should find a way to do what you want more directly or risk code maintenance issues and likely bugs in the future. Second, while the question isn't about your key strengthening step it seems like you should ask about the security. There are lots of good key derivation methods out there and I don't ...

-1

It depends on your definition of secure. What most experts agree on is that ECB is a bad idea. The wiki page actually provides a pretty solid overview http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation

Top 50 recent answers are included