3
$\begingroup$

We all know we should NOT roll our self-designed encryption algorithm, how about block cipher mode with a certificated cipher method like AES? Will a self-designed block cipher mode cause any flaws or weakness to the cipher?

I have search over the Internet but can't find a answer. Hope here is the right place to ask such a question.

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ why would you want that? what do you need that any of the proven modes of operation don't provide? $\endgroup$
    – countermode
    Mar 23, 2016 at 8:30
  • 1
    $\begingroup$ @countermode I ask this question just because there is no answer on the Internet and I want to get some professional advise here. $\endgroup$
    – Hartman
    Mar 23, 2016 at 10:50
  • $\begingroup$ @2awm366 it's important to know how you intend to apply your new mode of operation. For example, it would most likely be ill-advised to use a homebrew MoO in a security-critical application without thorough review. This is one of the reasons why countermode's question is pertinent. $\endgroup$
    – Jules
    Mar 23, 2016 at 14:17

2 Answers 2

Reset to default
3
$\begingroup$

Similar concerns apply as to any self-designed cryptographic algorithms. Standard block cipher modes usually have security proofs. If yours does not then even if it seems correct you may be missing some weakness.

An example of where security proofs of cipher modes are clearly important is the CCM mode (pdf). The same cipher key is used both for CBC-MAC authentication and to produce the CTR blocks used for encryption. This key-reuse is generally a bad idea and in a home-baked mode could be a weakness, but is proved safe in the particular composition used.

Very simple modes may be easy to prove secure yourself. However, I doubt those have any real advantages over using a standard mode either.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Also read this question and answer, which deals with self-designed crypto algorithms but also applies to modes of operation. $\endgroup$
    – malexmave
    Mar 23, 2016 at 8:21
3
$\begingroup$

There is a fundamental difference between designing your own algorithm (e.g., block cipher) and designing your own mode of operation. In particular, it is possible to formally prove the security of a mode of operation, and this is not possible with a block cipher. Thus, if you know how to prove security, then there isn't any reason not to do this. (Of course, you should in general have a reason for doing something that isn't currently covered by any standard. But, there are reasons that come up.)

Personally, I would never try to design a block cipher or the like, since this requires many years of expertise and even then is really hard. Even block ciphers designed by experts have flaws, so it's best to just use AES etc. However, I would design a mode of operation if I had a reason to. But then again, I have years of experience writing proofs. If you don't, then I would recommend to stay clear of this as well.

Improve this answer
$\endgroup$
3
  • $\begingroup$ ok, then may I ask how to proof a mode of operation secure or not? Although I'm a newbie here, I'm very interest about these topics. $\endgroup$
    – Hartman
    Mar 23, 2016 at 10:47
  • 1
    $\begingroup$ @2awm366, Lindell's Introduction to modern Cryptography contains a security proof for CTR and explains what authenticated encryption is and what to proof to consider a mode secure (i.e. CPA security and unforgeability). For a recent mode designed by Lindell and Gueron see GCM-SIV (PDF). $\endgroup$
    – SEJPM
    Mar 23, 2016 at 13:34
  • $\begingroup$ @SEJPM Thank for the explanation, I will take a look the PDF. $\endgroup$
    – Hartman
    Mar 23, 2016 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.