With block chipers can I assume that


Meaning if I decrypt something with a key k and then encrypt the result with the same key k, do I get what I originally had? Using the same BC scheme of course.

I can't right? It's possible that it has some random parts, no?

  • $\begingroup$ It depends on what you mean by "encrypt with a blockcipher". If you mean using a blockcipher in a secure mode of operation, then no, the probability of this happening will be negligible. $\endgroup$ – Maeher May 4 '14 at 11:21
  • $\begingroup$ I'm trying to find a collision to show that block ciphers are not collision resistant and can't therefore be used as compression function for hash or something like that. I thought that maybe Enc(k,m)=c would collide with Enc(k',Dec(k',c))=c, but that seemed slightly too easy. $\endgroup$ – Sunny May 4 '14 at 11:30

If by $\operatorname{Enc}$ and $\operatorname{Dec}$ you mean the application of the block cipher primitive to a single block, then yes, it is assumed to be deterministic. (Since the size of input and output block is the same, and we want to be able to decrypt again, there is no way to be nondeterministic.)

(Note that in "normal" encryption/decryption usage, you'll have not the block cipher primitive, but a block cipher with a mode of operation, and together the encryption is usually are not determined by just the key, as it is also using an initialization vector.)

When you are thinking about block ciphers in compression functions for hashes, you are usually taking the block cipher primitive, so your determinism is given.

For collision resistance of a hash function, you don't need to show that there are no collisions (this is impossible, if the input size is larger than the output size), just that it is "hard" to calculate them. (Or if you want to show that a function is not resistant, show that you somehow can calculate a collision.)

Your idea of creating a collision is good – you just have to show on how it applies to the way a message is encoded and then passed to the compression function (i.e. the block cipher) to find two colliding messages. (This depends on your concrete candidate hash function.)

This is also the reason that we don't use a "pure" block cipher in real live compression functions, but add some feedback of either the "key" or the "plaintext" or both into the output.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.