Tag Info

New answers tagged

4

They're both broken under known plaintext attack, where attacker knows two (plaintext, ciphertext) pairs, $(m_1,c_1)$ and $(m_2,c_2)$: $E'_1(k_1,k_2) := k_1 \oplus E(k_2,m)$ $E'_1(k1,m_1) \oplus E'_1(k1,m_2)=E(k1,m_1) \oplus E(k1,m_2)$ The attacker simply computes $E(k1,m_1) \oplus E(k1,m_2)$ for every possible value of $k_1$ and compares it with $c_1 ...


2

To emphasize that this isn't a generically good construction, we can show that AES with that tweak method is insecure (!). This observation is based on a simple 1 round differential characteristic; it starts off with a differential in one of the bytes, and a carefully chosen differential in the tweak. With this initial differential, after the AddRoundKey ...


2

This construction isn't generically secure, you need to analyze it for each blockcipher you want to use it with to see if it's secure. For example, consider a block cipher that simply xors the key into the state between rounds. In that case your construction is equivalent to xoring the tweak into the key. This has several consequences: Since we generally ...


3

You cannot encrypt 720 bits plaintext using just AES-128. AES is a 128 bit block cipher. Such a block cipher has an input of 128 bits of plaintext and an output of 128 bits ciphertext; and that's it. You need some kind of construction to make block ciphers encrypt larger or smaller plaintext. Such constructions are known as (block cipher) modes of ...


0

We really only need one plaintext-ciphertext pair, but the second can be used as a way to check candidate keys. Make a guess to the final subkey (ie guess all of them). Decrypt the final round of your ciphertext using your key. Store this result and the subkey you used. Repeat for all 2^16 candidates for the final subkey. Make a guess for the first three ...


2

I know that all the subkeys $k_i$ are derived from the main key $K$, but how? However the cipher designer feel like. The Feistel design gives guidance as to how the block is processed (and in a way to make inverting the cipher easy), however it gives no guidance as to actually generate the subkeys. The designers can do anything they like, and still ...


4

There are two well-known Encryption modes, that can construct a $mn$-bit tweakable blockciphers from a $n$-bit blockcipher ($n=64$ for DES) with $1\le m\le n$. The older one is CMC, being not parallelizable. It was superseeded by Encrypt-Mix-Encrypt (EME), which is parallelizable. The basic idea of the two algorithms is to encrypt each block of input data ...


3

In addition to the tweakable enciphering schemes in the comments, I'll leave this reference here: https://eprint.iacr.org/2009/356.pdf It essentially shows (in the ideal cipher model) that using an n-bit block cipher in a three-round Feistel construction gives you a 2n-bit block cipher.


-2

The problem with this question is that the question is incomplete. It's like asking the question "should I use a hammer or a screw driver". Without knowing the underlying application and requirements it is impossible to properly answer this question (in fact, the answer may be "tape measure"). Still, ECB and CBC each have their strengths and weaknesses. ...


2

For a truly random stream, since there are $2^n$ possible $n$-bit blocks, we expect a repeated n-bit block after looking at (roughly) the first $2^{n/2}$ blocks, by the birthday paradox argument. For the stream generated by this block cipher, provided that each input block is distinct (i.e. the counter does not start repeating) , the output blocks are ...


1

Stream ciphers are often used as pseudo random number generators so as long as the key isn't known you generally can't. There may be some statistical properties that may distinguish it from a hardware RNG as it is produces a well distributed key stream. If you generate enough bits from it you may find out that it never repeats blocks in the key stream. ...


0

why it should strictly be bijective instead of injective or surjective? Actually, it is injective and it is surjective; the term bijective just means that it satisfies both the properties of injectivity and surjectivity. Injective does not mean that there is a 'skip' (that's "not surjective"); instead, it states that no two different inputs give the ...



Top 50 recent answers are included