# Tag Info

13

The algorithm (now reasonably clear) is reminiscent of a block cipher in CFB mode, with $random$ as the IV (which can be public), $secret$ as the key, and MD5 used as keystream generator instead of the block cipher. Decryption works as in CFB: $$M_1 = C_1 \oplus \operatorname{MD5}( secret||random )$$ $$M_n = C_n \oplus \operatorname{MD5}( secret||C_{n-1} ... 10 A block cipher is an invertible transformation that maps an n bit block of bits to an n bit block of bits, under the control of a key (and where n=128 in the case of AES) Now, we most often need to do things other than mapping blocks of n bits; how we do that is using the block cipher within a Mode of Operation. A mode of operation is just a way to ... 9 If you look at the CBC diagram, you'll see that having a fixed IV is equivalent to having the first ciphertext block become the IV. If your cipher is a good pseudorandom permutation, then what you are doing does work, if and only if all timestamps are unique such that the "new IV" is unique and unpredictable. And in fact, if you do not use the ... 8 It's not clear from your decryption what the algorithm is used for. But you should be aware that while at first glance it provides privacy : it's a weird mode CFB with md5 used as a block cipher ; it doesn't provide authenticity. A simple bit flip of the ciphertext will result in the corresponding bit being flipped in the plaintext and such a bit flip ... 7 There is only one main difference between PKCS#5 and PKCS#7 padding is the block size. PKCS#5 padding is only defined for 8-byte block sizes. PKCS#7 padding would work for any block size from 1 to 255 bytes. This is the definition of PKCS#5 padding (6.2): The padding string PS shall consist of 8 - (||M|| mod 8) octets all having value 8 - (||M|| mod ... 7 If you could use the same IV, then yes, you would need to rewrite everything after the modified block. But you shouldn't do that; every time the contents change, you should generate a new IV, which would require the whole file to be rewritten. Otherwise an attacker can learn more information than it should about how the file changed (precisely by checking ... 7 The crucial difference between plain encryption and authenticated encryption (AE) is that AE additionally provides authenticity, while plain encryption provides only confidentiality. Let's investigate in detail these two notions. In the further text, we assume K to be a secret key, which is known to authorized parties, but unknown to attackers. Goals ... 6 EDIT: The following block of text (between the lines) was written as an answer to the original question, which did not explicitly state that the secret was used for any blocks after the initial one. Hmmm, I assume that the goal of this algorithm is to provide privacy; that is, to create an encrypted message, and someone that hears this encrypted message ... 5 The exact information leaked depends on the mode of operation that is in use. The simplest case is ECB, where a duplicate ciphertext block means that the corresponding plaintext blocks are also equal. For the CBC mode, when two ciphertext block are equal, i.e. C_i=C_j, we know that there was equality before applying the block cipher. This in turn ... 5 The same key is indeed used in EAX to key both the CTR mode and the underlying OMAC (which is actually used in 3 distinct phases: randomising the CTR nonce, authenticating the Additional Authenticated Data, and authenticating the Ciphertext). This is explicitly acknowledged in the security proof. Where EAX differs from a naive reuse of the key is that it ... 5 A 6-byte nonce can expect to receive a collision 0.01% of the time after around 240,000 nonce generations (based on a birthday attack). After 100 such rotations (a little under 17 years, based on your 2-month rotation policy), that comes out to a likelihood of just under 1% of experiencing a collision. On the surface, to me that seems like a reasonable ... 5 Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in ... 5 A block cipher is (or tries to be) a pseudorandom permutation on a given space. Let \mathcal{M} be the set of n-bit blocks for a given n. There are 2^n possible block values, and a permutation on \mathcal{M} sends each block value to another value. There are 2^n! such permutations. A block cipher is a mapping from key values (in a given key space ... 5 A mode of operation is an explicit method by which we use a block cipher (eg AES) to do more than just encrypt one block of data. For example, it may allow us to encrypt multiple blocks of data (eg ECB,CBC etc), provide us with some authenticated encryption (eg GCM) or a method for encrypting disc storage (eg XTS). Rijndael,DES etc are block ciphers. That ... 5 I do not remember if we checked this explicitly, but my guess is that in the chosen-plaintext setting the biclique attack would still be faster than the exhaustive search, maybe by the factor of 2 compared with 4 in the chosen-ciphertext setting. However, both results are pretty far from declaring AES broken in any sense. Such small gain over exhaustive ... 5 Absolutely. The key point is that, whilst in CBC mode, the encryption can be thought of as using the previous ciphertext as the IV - have a look at this diagram from wikipedia: I assume from what you've said that you have a function that will "do" AES-CBC decryption on large amounts of data, and you wish to use this. So, you simply run:$$ D_k^{IV}(c_1\ ...

4

To answer your question: yes, GMAC does have niche applications where it performs better than either HMAC or CMAC; however it might not make sense for you. First of all, you are correct in that GMAC requires an IV, and bad things happen if a particular IV value is reused; this rather rules out GMAC for some applications, and is a cost even for applications ...

4

Yes, of course you need to know the mode of operation in order to decrypt. On the other hand, the mode of operation isn't usually explicitly transmitted in the ciphertext. Using the same key with different modes of operation may cause unexpected weaknesses. For example, consider one message encrypted with CFB mode with IV=2 (which is perfectly secure) and ...

4

For all standard modes, AES isn't secure at all if you reveal the key; even if you keep the IV hidden. Exactly how this works out varies between modes; for CBC mode, the attacker will be able to decrypt the entire text except for the first block (well, last block because of your reversing the file), even if you didn't give him an IV. The same goes for CFB ...

4

An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher. Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination. Essentially these xor a key-stream into the message to encrypt it ...

4

As noted in archie's answer to your earlier question, the EAX paper first defines a generic encrypt-then-MAC composition method called EAX2, with separate keys for the encryption and MAC components, and proves its security (Appendix C). It then defines EAX as EAX2 instantiated with CTR mode and OMAC, and with the same key used for both components, and then ...

4

See minar's answer if you used ECB or CBC mode to encrypt (and CFB mode is similar to CBC mode -- if you find a colliding pair, you can deduce the relationship between two plaintext blocks). On the other hand, one of the things that Major Major ignores is that there are modes for which a duplicate block does not leak anything. Consider counter mode (CTR); ...

4

A "cipher" is the algorithm which encrypts and decrypts data, while the "cipher-mode" defines how the cipher encrypts and decrypts it. In other words: ciphers are the cryptographic algorithms that you use to encrypt/decrypt data, while cipher-modes define the "mode of operation" for applying the cipher. Both are complementary and can be chosen separately. ...

3

The $1/2^{32}$ is an arbitrary figure, based upon one particular value for what counts as an acceptable risk. You need to decide what is an acceptable risk. If you think that a $1/2^{32}$ probability of failure is an acceptable risk, then this calculation is relevant to you. If you think it isn't, then decide what you think is an acceptable risk and re-do ...

3

Sure, basically GCM is counter mode encryption with an authentication tag added. You can encrypt any part of the stream without issue if you know the key and the counter for that part. Obviously, you cannot check the integrity though, because the tag is the integrity of the entire file. Basically, you only have to perform the top part of the scheme:

3

A tweakable blockcipher where the tweak is set to a counter, and the plaintext gets encrypted directly has the same properties as your idea. When these properties are desired, you can use either a specialized tweakable blockcipher such as threefish, or you turn a normal blockcipher into a tweakable blockcipher. When using AES, a typical choice is XTS, ...

3

As @fgrieu mentioned, what you're after is FPE. The papers he linked deal with FPE on a very small domain, but it looks like you're interested in encrypting longer strings. For that, you need a wideblock cipher. Unlike traditional blockciphers, these typically allow different input lengths, which is a plus. They meet your criterion of not revealing shared ...

3

Sure, that's fine, but you're really just using the first block of ciphertext as the IV. If you choose the first plaintext block to be a running message counter (which you might as well do; it's easier than generating a random block) and your "discarded IV" to be all zeros (or vice versa) then your method is equivalent to standard CBC mode combined with the ...

3

Modes of operation are generally supposed to be independent of the underlying block cipher. They generally have a proof of security showing that the security of a system using said mode reduces to the security of the block cipher. However some modes, such as CTR, don't work well with block ciphers of short length (aka, old ciphers) and can leak information. ...

3

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

Only top voted, non community-wiki answers of a minimum length are eligible