Tag Info

New answers tagged

0

If you look in the OCB submission for CAESAR, you will see that the designers state the security is similar to that of GCM. I would note, however, that GCM has been shown to posses weak key classes, see e.g. https://eprint.iacr.org/2013/144.pdf https://eprint.iacr.org/2011/202.pdf http://www.ecrypt.eu.org/hash2011/proceedings/hash2011_03.pdf ...


3

I would pick EAX as it is by far the simplest to implement and therefore to understand and audit. It is reasonably fast if based on AES. GCM seems quite popular, but I personally see a number of issues with it: it is very difficult to implement in software (which is not surprising, since it was developed with hardware in mind). it is slower than it seems ...


5

GCM Personally, I would go for GCM (Galois Counter Mode) since it is efficient – meaning: it handles pretty much everything you’ld expect from it, while other modes sometimes tend to lack a specific feature here and there (see image below for a comparison that shows what I’m hinting at). Also, GCM has a pretty good performance (assuming non-flawed ...


1

I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The construction is only used in the v1.x of AEZ, because it requires appriximately 1.8 AES calls per block of plaintext, while the one used in v2.0 requires only 1 AES per block ...


1

All of them can be used to deal with unreliable, unordered datagrams; as long as you can derive an IV for the UDP packet then a cipher mode of operation should succeed. You need some kind of unique method of identifying the packet of course. Note that (the information used to generate the) IV may be public. Usually you need some way of identifying the ...


6

The point of the IV is to prevent the same (key,IV) from ever being used for two different messages in practice. This is an absolute requirement for stream ciphers or block cipher modes such as CTR that are effectively stream ciphers, because re-using the same (key,IV) pair lets an eavesdropper trivially obtain the XOR of two plaintext messages, which means ...


4

You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset. Note that using a stream cipher or counter mode is NOT secure if the data is ever modified in the file, as it would violate the cardinal sin of using the same key and initialization vector to ...


3

The catch how ever is that if a small part of the file is given along with the location of that bytes from the beginning of the file we should be able to decrypt just that piece. Normal CTR mode encryption allows one to decrypt any block of the file independent of the rest, so no need to invent your own mode. With AES the block size is always 128 bits, ...



Top 50 recent answers are included