I have several questions on using AES 128bit in the BPS format preserving encryption

Which modes are acceptable? (Should the block cipher used at each round be deterministic (ECB) or probabilistic (CBC, CTR etc)

What IV to set? Can I set it to the constant zero?


1 Answer 1


AES is directly used as a block cipher without a mode of operation in BC / BPS.

This would be identical to ECB mode for one block or CBC mode for one block and a zero IV in the case that the block cipher itself is not directly available. In that case you should not pad or remove a full block of padding if padding cannot be avoided. CTR of one block with a zero IV/nonce would also work.

But basically the answer to "what modes are acceptable" is: none. In that case the IV is also not applicable. The tweak can be seen as a specific kind of IV. Likewise you could see BC itself as a mode of operation for the block cipher.

  • 2
    $\begingroup$ Indeed, since AES is used as a raw block cipher in BPS, AES does not need an IV. But if we use BPS repeatedly, in order to make it secure, BPS needs a different tweak at each use, and an IV could be used to define (the initial value of) that tweak (which, when enciphering multiple symbols, could be much like the counter in AES-CTR). $\endgroup$
    – fgrieu
    Commented Oct 1, 2015 at 8:57
  • $\begingroup$ I'm implementing this in C# and I'm as far as calculating the first round, and the result from AES encryption returns a byte array of 16 bytes. What is the proper way to perform the modular addition with L or R? (They are currently integers) (i.e. what to convert the AES byte array to? I tried converting to BigInteger but it yields a large negative number) Should I continue with the modular addition or do you think I'm doing something wrong? $\endgroup$
    – erotavlas
    Commented Oct 2, 2015 at 19:46
  • 1
    $\begingroup$ @erotavlas Could you make that questions on SO? Note that BigInteger is little endian, and that it doesn't matter too much for the lower bytes if you are adding a negative number (think about it). $\endgroup$
    – Maarten Bodewes
    Commented Oct 2, 2015 at 20:37
  • $\begingroup$ @MaartenBodewes Do you know of any alternative crypto forums (outside StackExchange) where people check each others algorithms or implementations? Does anything like that exist? Do you think trying to contact the authors of the papers for test vectors is worth a shot? $\endgroup$
    – erotavlas
    Commented Oct 2, 2015 at 23:12
  • 1
    $\begingroup$ @erotavlas Yes, if I cannot find test vectors I do contact the authors. If you are polite they normally are more than happy to help. I do normally point to this site as well, in the hope they join up. $\endgroup$
    – Maarten Bodewes
    Commented Oct 2, 2015 at 23:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.