1
$\begingroup$

If I encrypt a 1MiB file with AES-CBC (or any other cipher) and XOR a 128KiB of (truly) unpredictable random data repeating until the end of file, will I have a security of 1048576-bits (128KiB*8)?

This question is a little weird, but I would like to know if this scheme has a security flaw (maybe known-plaintext attacks).

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$

This will be only as secure as AES-CBC, as the repeating XOR you're describing is massively vulnerable to a myriad of attacks, including known-plaintext attacks. Also remember that you could "cancel out" the 128 KiB by XORing two blocks together, since $P_1 \oplus K \oplus P_2 \oplus K = P_1 \oplus P_2$.

Don't try to chase large key sizes. 256 bits of key material is more than enough.

Improve this answer
$\endgroup$
6
  • $\begingroup$ Yes, I was trying to chase large key sizes, pardon me. =) $\endgroup$
    – phantomcraft
    Nov 28, 2022 at 0:57
  • 1
    $\begingroup$ @phantomcraft There's really no need to do that. 256 bits is plenty, although you can use XTS to get a little more strength for "free" (384 bits when you take into account meet-in-the-middle). $\endgroup$
    – forest ♦
    Nov 28, 2022 at 0:58
  • $\begingroup$ In a quantum scenario I would get 192-bits with AES-256-XTS, am I right? $\endgroup$
    – phantomcraft
    Nov 28, 2022 at 1:06
  • 1
    $\begingroup$ @phantomcraft Well, sort of, but see crypto.stackexchange.com/a/102672/54184. While it would reduce it to 192 bits, quantum computers simply don't scale when running Grover's algorithm. Even 256 bits (thus 128 vs Grover's) is more than enough. $\endgroup$
    – forest ♦
    Nov 28, 2022 at 1:08
  • 1
    $\begingroup$ They can, but $2^{128}$ quantum operations is way more difficult to achieve than $2^{128}$ classical operations. $\endgroup$
    – forest ♦
    Nov 28, 2022 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.