# Tag Info

10

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...

6

AES-128 takes a 128-bit key, produces 11 128-bit subkeys out of it with a cryptographically weak function, and uses them in 10 internal rounds. It can be said that the full key is reused 10 times. AES-192 takes a 192-bit key, produces 13 128-bit subkeys out of it (or, equivalently, 9 192-bit subkeys), and uses them in 12 rounds. The full key is reused 8 ...

5

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on randomly generated data of the kind it requires. If it can break some challenge (e.g. these), do it. Post the results to the challenger or show the results ...

3

They are referring to the formula for Bézout's identity which calculates the greatest common divisor, extended to a finite field, where 1 is the multiplicative neutral element. From the relation $b(x)a(x)+m(x)c(x)=1$, $$b^{-1}(x)=a(x)\mod m(x)$$ I cant figure out what $a(x)$ and $c(x)$ are? In this case, $b(x)$ is the element for which the inverse is ...

3

I'm not seeing any particularity between the two field that they build, but exists? First off, one basic truth about finite fields is that there is at most one finite field of a given size. Given that both $x^7 + x + 1$ and $x^7 + x^4 + x^3 + x^2 + 1$ are both irreducible, they both generate the same finite field. Where they differ is the ...

3

I am using chunks of 1MB and give them a GUID as filename That is fine although unnecessary, the entire input file can be encrypted. These chunks are then first compresses using DEFLATE to minimize attacks based on known Content VERY BAD idea, since you are breaking the input file into pieces, you are now exposing the entropy of specific file ...

3

According to the original NESSIE submission of Whirlpool: "The ﬁnite ﬁeld ${\rm GF}(2^8)$ will be represented as ${\rm GF}(2)[x]/p(x)$, where $p(x) =$ $x^8 +$ $x^4 +$ $x^3 +$ $x^2 +$ $1$ is the ﬁrst primitive polynomial of degree $8$ listed in [19]. The polynomial $p(x)$ was chosen so that $g(x) = x$ is a generator of ${\rm GF}(2^8) \setminus \{0\}$." ...

2

I guess that a single e-mail to Vincent Rijmen might solve this problem, but I would speculate that the new S-box should have been more hardware-friendly compared to that of Rijndael. The recursive structure of $W$ and smaller constants in the MDS matrix may have required another field representation.

2

As fgrieu already pointed out, using a OWF in the way you describe would make the key schedule not efficiently invertible (or even not invertible at all), meaning you would need more memory/chip space to store the user-input key in order to efficiently encrypt more than one block. In terms of other implications, if the key-state update function $e_n(\cdot)$ ...

2

Assuming for the moment that your claim is correct, I would suggest caution in revealing the details of your findings. After having your results validated by one or two people with the skills to do so (and whom you trust to keep things confidential), then some sort of general announcement (without specifics) would be best, to give people time (say three ...

2

What you are looking to do can be done, but if you expect it to just work, you are mistaken. Performing the calculation of the inverse here is the easy part, the hard part is the choice of affine transform polynomial and vector, as incorrect choice will lead to an insecure s-box. Multiplicative Inverse The most simple method of calculating the inverse is ...

1

The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of rounds, for which you would have to do the same. Also, what's the point? 256-bit keys are enough for all eternity. Using a longer keylength variant would likely ...

1

"Serial concatenation" is not a standard term in cryptography. Without any further information, I would guess that it probably refers to just concatenation. If that's not what it refers to, then your spec is deficient and ambiguous; you'll need to consult with the author of the spec to ask for to clarify what they meant by that phrase.

Only top voted, non community-wiki answers of a minimum length are eligible