10 questions linked to/from What is the ideal cipher model?
2k views

### Why is DES not an ideal cipher?

From Cryptography I on Coursera, Week 2, "Exhaustive Key Search Attacks": Now let's assume that DES is what's called an ideal cipher [...] Of course, DES is not a collection of 2^56 random ...
• 407
2k views

### Formally, what is AES?

AES is supposed to be a symmetric key block cipher. The theoretical counterpart to this is a pseudorandom permutation. I'd like to say that AES is a PRP (well, supposedly at least), but that doesn't ...
• 249
2k views

### Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
• 449
847 views

### Has there been any cryptanalysis of AES under a non-uniformly distributed key?

The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from ...
• 4,378
1k views

### Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
196 views

### Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key ...
• 15.3k
854 views

### Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the sub-...
• 2,140
297 views

### Security of Even-Mansour scheme with keyed shuffle?

I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful. What if a permutation that uses secret data like the ...
• 19.6k
Suppose we have an $n$ bit ciphertext $c$ protected by a $k$ bit $MAC$, with $k < n$. Generally, we expect collisions after $O(2^{k/2})$ ciphertext/MAC pairs are seen. Consider the following ...