# Tag Info

2

Yes, we always have to pad the message. The reason is simple: How do we know if the message has a padding or not if we don't always pad? Let's say we pad with adding only $0$ bits. We got the (after padding) message $0101\,1100\,0000\,0000$ and a block size of 2 bytes (16 bits). Well, what was the original message? Was it $0101\,11$? Or was it $0101\,1100$? ...

2

SSL padding always pads, using 1..blocksize bytes (8 bytes for triple DES, 16 for AES). This padding makes it deterministic independently of the value of the plaintext. It's a padding mode similar to ISO 10126 (only the last padding byte is one less). Other padding values - such as the zero padding performed by PHP's mcrypt library - are also ...

0

Well, the definition of a PRP says that given an oracle access to either PRP or a truly random permutation the adversary cannot tell which permutation is behind it (i.e. random or pseudorandom). Formally, for every adversary $A$, for every positive polynomial $p$ and for the sufficiently large $n$'s ($n$ is the security parameter) it holds that: $| ... 1 If I understand you correctly, you want to use the decryption process of CBC to encrypt, i.e., This would not be CPA secure. The problem is, as you already noted, that the IV has no influence on any block but the first one. I.e. a CPA attacker works as follows: Choose two random messages of length 2 blocks$(m_0^0,m_0^1)$and$(m_1^0,m_1^1)\$ and output ...

1

For CBC mode, the IV can be generated in any manner where it would be unpredictable to an attacker from one message to the next. In practice that means a random number generator of some kind. Since the block size is 128-bits, the probability of IV repeat before the key expiration is negligible. The CBC IV is visible to an attacker viewing your ciphertext; as ...

0

I think the best reference for the exact way block modes work is the Wikipedia article on the matter: http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation (They can be found in a lot of books, Wiki is just easier to reach). Regarding the IV exchange, AES by itself doesn't do such a thing. Generally, secret exchange is done using asymmetric ...

1

To show that a family of functions is not a PRP, you have to either show that the functions are not permutations or that they do not behave pseudo-randomly. As it is already established that the functions are in fact permutation you need to show the latter. For a family of permutations to be a PRP means that it is computationally infeasible to distinguish a ...

0

It would really help to see the encryption and decryption code, as used by your program. The Handling of the IV does not seem right. The IV has the size of the block of the cipher used in conjunction with CBC. Thus it should probably be 16 bytes in length. Additionally you have to use the RAW bytes for CBC and not its Base64 representation. In order to ...

Top 50 recent answers are included