# Tag Info

11

I'm just curious to know why the 128-bit version become the standard[.] That question is easy to respond. In the section Minimum Acceptability Requirements of Request for Candidate Algorithm Nominations for the AES, it says: The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-128, 192-128, and 256-128 ...

8

I can immediately think of four reasons: They're both not using AES256. I see in the Obj-C document a direct statement that they are using AES256 (unless you deliberately change it), I don't see any statement in the Visual Basic document that says what key size they're using (unless that's what they mean by "Block Bits"). Different keys. AES256 takes a ...

7

Rijndael (the algorithm behind AES) is specified with block sizes and key sizes of 128, 160, 192, 224 and 256, in any combination of block and key size. (Thus, Wikipedia was wrong with the keysize has no theoretical maximum here, though one could invent extensions of the key schedule algorithm which allow longer keys. See below for details. I now fixed this ...

5

The S-Box was generated when Rijndael was designed, not in any step. It's used in every round in the SubBytes step. The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael. In fact, this is it: | 0 1 2 3 4 5 6 7 8 9 a b c d e f ...

5

That variation directly implements Rinjdael's ShiftRow as specified (section 4.2.2) in the proposal to NIST, defining Shitftrows for 128, 192 and 256-bit block size (Nb=4, 6 and 8). Loosely speaking, the offsets improve the mixing (diffusion) properties of consecutive rounds of the cipher. More precisely the authors state their motivation (section 7.4) ...

4

Prompted by Paŭlo's comment, I took a look at the original requirements set out for the AES candidates. A useful page for that turns out to be AES - The Early Years (1997-98) on the NIST web site (and surprisingly hard to find there; the internal links are broken and Google doesn't find it either). The AES key lengths were specified in the original Request ...

3

Rcon(9) is 0x1b because 0x80 multiplied by 0x02 is 0x100, which is reduced to 0x00 xor 0x1b in the finite field. Rcon(10) is twice Rcon(9), and so forth. Rcon(0) is 0x8d because 0x8d multiplied by 0x02 is 0x01 in the finite field. If what I mean by finite field is not understood, it is because the numbers you are dealing with are actually polynomials, ...

3

It has to do with the alignment between the size of cipher the key and the size of a round key. Since a 256-bit key is twice the size of a round key, the nonlinearity of the key schedule would be aligned to every other block, and that is bad. Here is an example of the round keys generated by the key schedule for a key (hex bytes) of value ...

3

During the final round of the AES contest, NIST issued a summary of the 5 finalists on the topics of security, speed, implementation, and such. That sounds like what you're looking for, see sections 3 and 5 of the paper. General ideas from the paper: Rijndael had a potentially lower security margin than Twofish and Serpent. Rijndael had better performance ...

2

About the best you can do is have a master public/private key pair where the public key is stored on your server and the private key is stored offline. When you generate a new private key, encrypt it with the master public key and store that in the database. That way, if a password is ever lost, you can recover the user's private key by using the master ...

2

AES always has a blocksize of 128, and a keysize of 128, 192 or 256 bits, because NIST only standardized those modes. Rijndael on the other hand is more flexible regarding parameters. Wikipedia says: AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits, whereas Rijndael can be specified with block and key sizes in any multiple ...

2

Your assumption is flawed, you are thinking the IV used for encryption and decryption are different, and that the decrypt IV is an output from the cipher. It is only an input, and it is the same for both operations. Therefore it does not leak any information about the key or the plaintext. Is using the IV in such a way, which can keep both sides of a ...

2

I assume you mean that the CBC-mode encryption and decryption process would 'update' the "output IV" will be identical to the most recent ciphertext block. This isn't obvious from your question; for example, the diagrams you show don't show any "output IV" being generated at all. Now, for your specific questions: Does this "Output IV" holds information ...

2

To give some general intuition: Longer keys give the attacker more "degrees of freedom" in a related-key attack. Therefore, defending against related-key attacks likely requires more complex key schedule if the key is long, than if the key is short. That might explain, at a conceptual level, why 256-bit keys require more complexity in the key schedule. ...

1

"Serial concatenation" is not a standard term in cryptography. Without any further information, I would guess that it probably refers to just concatenation. If that's not what it refers to, then your spec is deficient and ambiguous; you'll need to consult with the author of the spec to ask for to clarify what they meant by that phrase.

1

I'm assuming there are holes in your question, but I'll answer it as is and then you'll probably want to change the question. Although please also see this question as it might answer your question too. The probability of decrypting an AES encrypted ciphertext is $1$ if you have the right key and (practically) $0$ if you have the wrong key. This is ...

1

There are two well-known distinguishers of reduced-rounds version of AES based on integral cryptanalysis. The first one is a 3-rounds distinguisher from Daemen and Rijmen while the other is a 4-rounds distinguisher from Gilbert and Minier. The 3-rounds distinguisher relies on the fact that one byte $y$ of the state in the third round is the xor of four ...

1

It has to do with how the key schedule generates round keys (see my answer to your other question). Each round key is 128-bits in AES (or the number of bits in the block size for Rijndael). So if you have a 192-bit key, the key schedule picks a subset of the key bits for each round. Repeat that for 10 to 14 rounds (depending on key size) and you will use all ...

Only top voted, non community-wiki answers of a minimum length are eligible