# Tag Info

0

If each round key is of the same size of the block to be encrypted and all round keys are truly randomly generated independent from each other, then we have OTP. This is similar to using a truly randomly generated key of the same size of the plaintext to be encrypted. Each bit of this key is used only one-time to encrypt one plaintext bit.

3

There are two ways a cipher can be broken: theoretically and practically. If the paper is correct then: Our fastest attack achieves a nearly feasible $T=2^{101}$ (cf. Section 28.6 and [28]). (emphasis mine) If we verify this claim then we get: If we have a diverse population of at least $2^{79}$ diﬀerent 256-bit GOST keys generated at random, with ...

1

How the cipher key is scheduled if it is less than 128 bit (for AES 128), or less than 192 bit (for AES 192) or less than 256 (for AES 256)? That is undefined; the AES specification does not address that possibility. The AES 128 algorithm assumes that you give it 128 bits of key (and tells you exactly what to do with that key); it says nothing about ...

1

Yes, but. While EME is a secure block cipher, its security is not as good as a regular block cipher of that size would be. Theorem 1 of the linked paper shows that the adversary has an advantage after ~$2^{n/2}$ oracle queries, which is expected with an $n$-bit block cipher, rather than $2^{m/2}$ as we would desire for an $m$-bit wide block cipher. Since ...

3

No, because CFB isn't commutative. You can see this by looking at the decryption of double-CFB encrypted ciphertext. Even assuming a constant IV (so single-use keys), if you decrypt in the wrong order it cannot work, since the ciphertext is used as input into the block cipher and will differ from what was used with that key when encrypting. The exception, ...

1

To make notations simpler, I note $R_i = F(k_i, IV_i)$. Then: $$C_1 = P \oplus R_1$$ $$C_2 = P \oplus R_1 \oplus R_2$$ $$C_3 = P \oplus R_2$$ Therefore: $$C_1 \oplus C_2 \oplus C_3 = P \oplus R_1 \oplus P \oplus R_1 \oplus R_2 \oplus P \oplus R_2 = P$$ Your protocol looks like Shamir's three-pass protocol but it requires a bit more than mere commutativity, ...

1

Yes it is possible for a passive eavesdropper to recover the secret $P$. Here's how: The attacker observes $C_1,C_2,C_3$ and formes the XOR of all those values. That's it, the result of $C_1\oplus C_2 \oplus C_3=P\oplus F(K_1,IV_1)\oplus P \oplus F(K_1,IV_1) \oplus F(K_2,IV_2) \oplus P \oplus F(K_2,IV_2)=P$ yields the desired plaintext.

3

This question is based on opinion. At least kind-of. But the variants from which one can choose are quite a few. As for general construction the sponge construction (like Keccak / SHA-3 uses) are very versatile and can be used for many purposes, for example hashing, authenticating (= "MAC'ing"), authenticated encryption (see “General Overview of the ...

Top 50 recent answers are included