# Tag Info

14

No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible: a -> a b -> b c -> c but also: a -> b b -> c c -> a and a -> c b -> a c -> b and a -> c b -> b c -> a (there should be $6$ for $3!$, the ...

8

The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In particular, a man-in-the-middle can capture the client's public key, can forward its own public key to the server, and can then decrypt all traffic sent by each ...

6

There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to happen when you encrypt too many blocks. Specifically, for an $n$-bit block size, the birthday paradox kicks in at $\sqrt{2^n}$. So, for a 128-bit block, you need ...

6

First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^126.1 operations, if we had a computer (or cluster) several million times more efficient than any current computer and could operate at the thermodynamic ...

5

This begs the question, why would you in any real-world circumstance wish to reduce the difficulty for an attacker to break your cryptosystem? To answer your question practically, the only reasonable way I can think of to accomplish this is to simply reduce the entropy in the key. At 100%, all 128 bits of the key are used. At 50%, 64 bits of the key are ...

5

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it receive? Almost none. Bad idea.

4

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the responses follow: First off, the authors are working on a design rationale in english for their new cipher. As soon as it's published, it will be linked ...

3

You cannot encrypt 720 bits plaintext using just AES-128. AES is a 128 bit block cipher. Such a block cipher has an input of 128 bits of plaintext and an output of 128 bits ciphertext; and that's it. You need some kind of construction to make block ciphers encrypt larger or smaller plaintext. Such constructions are known as (block cipher) modes of ...

2

how do you add an 256 bit round key? Actually, each round key is 128 bits, and so XORing them into the state matrix is easy. What the AES key expansion process does is take the 256 bit AES key, and generate 15 round keys (one more than the number of AES rounds). Now, for AES256, the first two round keys are, in fact, 256 bits taken directly from the ...

1

What you're describing is a ciphertext-only attack on AES. No, there's no (known) ciphertext-only attack on AES. Condition one: We know none of the weaknesses and similar plain-texts in these two blocks, I just mentioned, how easily could we discover it? By the lack of an transmitted IV, an attacker can learn whether the two messages are equal and ...

1

How the cipher key is scheduled if it is less than 128 bit (for AES 128), or less than 192 bit (for AES 192) or less than 256 (for AES 256)? That is undefined; the AES specification does not address that possibility. The AES 128 algorithm assumes that you give it 128 bits of key (and tells you exactly what to do with that key); it says nothing about ...

1

To do EEA on a finite-field, you can't perform the operations using the operations in the ring of the integers (and they're not precisely the same operations in the field either, as you're working with bit vectors, not field elements). In particular: When you do "addition", you need to perform the addition as done in even characteristic fields (that is, ...

1

As I have duplicated your question by mistake and non of us have had an answer, I request help to the authors to know why those parameters where selected like that. The affine transformation is a vector space operation $(\mathbb{F}_{2})^8$, and the simplicity comes from the fact that, from the bunch of possible transformations the one used can be also ...

1

Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice. I've understood the other way around. The affine transformation is over the vector space $((GF(2))^8$ and what they've say as simplicity was that, between all the possible affine transformations they select one that can also be described as ...

1

Why not use the mature, analysed, and successful pattern of PGP communications? First each party exchange the public keys of both the Client and Server. Even better out of band verify them depending on your threat model (i.e. phone call or some other independent method of verification of each side's identity and public key fingerprints) which prevents ...

Only top voted, non community-wiki answers of a minimum length are eligible