0
$\begingroup$

For a single block of 16 bytes...

The following is the workflow of AES-128 FIPS-197 which produces the correct output using NIST test vector from page 35:

C.1 AES-128 (Nk=4, Nr=10)
PLAINTEXT: 00112233445566778899aabbccddeeff
KEY: 000102030405060708090a0b0c0d0e0f
CIPHERTEXT: 69c4e0d86a7b0430d8cdb78070b4c55a
  • Input PlainText XOR Cipher Key =
  • (Start of Round 1, SubBytes, ShiftRows, MixColumns) XOR RoundKey 1 =
  • (Start of Round 2, SubBytes, ShiftRows, MixColumns) XOR RoundKey 2 =
  • (Start of Round 3, SubBytes, ShiftRows, MixColumns) XOR RoundKey 3 =
  • (Start of Round 4, SubBytes, ShiftRows, MixColumns) XOR RoundKey 4 =
  • (Start of Round 5, SubBytes, ShiftRows, MixColumns) XOR RoundKey 5 =
  • (Start of Round 6, SubBytes, ShiftRows, MixColumns) XOR RoundKey 6 =
  • (Start of Round 7, SubBytes, ShiftRows, MixColumns) XOR RoundKey 7 =
  • (Start of Round 8, SubBytes, ShiftRows, MixColumns) XOR RoundKey 8 =
  • (Start of Round 9, SubBytes, ShiftRows, MixColumns) XOR RoundKey 9 =
  • (Start of Round 10, SubBytes, ShiftRows) XOR RoundKey 10 =
  • Output CipherText

Screenshot

AES_128_ENC_FIPS_197

Next, is the workflow of AES-128 in CBC mode which does not produce the correct output using NIST Test Values from Cryptographic Standards and Guidelines under section Rijndael Information:

FILENAME:  "cbc_e_m.txt"

Cipher Block Chaining (CBC) Mode - ENCRYPTION
Monte Carlo Test

Algorithm Name: Rijndael
Principal Submitter: Joan Daemen

==========

KEYSIZE=128

I=0
KEY=00000000000000000000000000000000
IV=00000000000000000000000000000000
PT=00000000000000000000000000000000
CT=8A05FC5E095AF4848A08D328D3688E3D

I=1
KEY=8A05FC5E095AF4848A08D328D3688E3D
IV=8A05FC5E095AF4848A08D328D3688E3D
PT=204F17E2444381F6114FF53934C0BCD3
CT=192D9B3AA10BB2F7846CCBA0085C657A
  • (Input PlainText XOR InitializationVector) XOR Cipher Key =
  • (Start of Round 1, SubBytes, ShiftRows, MixColumns) XOR RoundKey 1 =
  • (Start of Round 2, SubBytes, ShiftRows, MixColumns) XOR RoundKey 2 =
  • (Start of Round 3, SubBytes, ShiftRows, MixColumns) XOR RoundKey 3 =
  • (Start of Round 4, SubBytes, ShiftRows, MixColumns) XOR RoundKey 4 =
  • (Start of Round 5, SubBytes, ShiftRows, MixColumns) XOR RoundKey 5 =
  • (Start of Round 6, SubBytes, ShiftRows, MixColumns) XOR RoundKey 6 =
  • (Start of Round 7, SubBytes, ShiftRows, MixColumns) XOR RoundKey 7 =
  • (Start of Round 8, SubBytes, ShiftRows, MixColumns) XOR RoundKey 8 =
  • (Start of Round 9, SubBytes, ShiftRows, MixColumns) XOR RoundKey 9 =
  • (Start of Round 10, SubBytes, ShiftRows) XOR RoundKey 10 =
  • Output CipherText

Screenshot

enter image description here

My question is regarding CBC. Am I missing something based on the CBC workflow I've listed above? Keep in mind this is just for a single block. The only block.

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
0
$\begingroup$

The first workflow is for the block cipher AES with a 128-bit key, known as AES-128; or equivalently AES-128-ECB and a plaintext of 16 bytes without padding. Notice that when the AES key is 128-bit (16 bytes), it's also RoundKey 0, applied before the first round.

The second workflow is for AES-128-CBC and a plaintext of 16 bytes without padding. An alternate description is: encipher (Input PlainText XOR InitializationVector) using AES-128.

If the result of the implementation of the second workflow does not match a test vector, then the implementation differs from the description given; or the test vector in not for AES-128-CBC and a plaintext of 16 bytes without padding; or somewhat the test vector is wrong. We can't tell because we have neither the test vector, nor the input and output of the implementation.

Difference between AES-128 FIPS-197 & AES-128 CBC workflow

AES-128 FIPS-197 is for a single 16-byte block.

AES-128 CBC is for plaintext of variable size. If there is no padding, that size is a multiple of 16 bytes. With padding that size is arbitrary, but then the ciphertext is longer than the plaintext even when not accounting for the initialization vector.

CBC encryption works by XORing each input plaintext block (after padding if any) with the previous ciphertext block, or with the initialization vector for the first block; then encrypting the result of that XOR to produce a ciphertext block.

Improve this answer
$\endgroup$
4
  • $\begingroup$ I have updated the question to include the test vectors, missing information and hopefully a comprehensive illustration of the process. Hope this helps. For CBC I am using the Monte Carlo Test Vectors. I wonder if this is the problem... $\endgroup$
    – suchislife
    Commented Apr 28 at 16:06
  • $\begingroup$ OMG... Looks like it was! I'm not an expert in encryption but, what are the Monte Carlo test vectors for? For wasting HOURS of you life? I've just tried again this time with KAT Vectors from Cryptographic Algorithm Validation Program and it worked! $\endgroup$
    – suchislife
    Commented Apr 28 at 16:17
  • $\begingroup$ So the answer is to use AES Known Answer Test (KAT) Vectors. $\endgroup$
    – suchislife
    Commented Apr 28 at 23:34
  • $\begingroup$ @suchislife: As documented there, Monte Carlo Test - CBC performs 1000 chained AES operations, not 1 as the KAT test vectors do. This explains the observations reported. The rationale for the MC testing is to reliably catch rare cases like a 1-bit error in some large table the implementation under test might use. $\endgroup$
    – fgrieu ♦
    Commented Apr 29 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.