Linked Questions

12
votes
2answers
2k views

Why is DES not an ideal cipher?

From Cryptography I on Coursera, Week 2, "Exhaustive Key Search Attacks": Now let's assume that DES is what's called an ideal cipher [...] Of course, DES is not a collection of 2^56 random ...
9
votes
1answer
2k views

Formally, what is AES?

AES is supposed to be a symmetric key block cipher. The theoretical counterpart to this is a pseudorandom permutation. I'd like to say that AES is a PRP (well, supposedly at least), but that doesn't ...
1
vote
5answers
472 views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
3
votes
2answers
687 views

Has there been any cryptanalysis of AES under a non-uniformly distributed key?

The standard security property demanded of a blockcipher is that it be a pseudo-random permutation; i.e., given a uniformly random key, the blockcipher should be computationally indistinguishable from ...
0
votes
2answers
1k views

Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
3
votes
1answer
802 views

Can you help me with this DES variant analysis?

I'm struggling with some DES variant that I got as an exercise (exercise taken from Katz-Lindell Ex5.14). The variant is as follows: The left half of the master key is used to derive all the sub-...
2
votes
2answers
152 views

Counter mode with $\operatorname{AES}_k(m)$ vs $\operatorname{AES}_m(k)$

In theory, for an ideal cipher $E_k: \{0,1\}^{128} \to \{0,1\}^{128}$, it would be completely fine to use the key and the input interchangeably, but obviously AES is not perfect. For AES128, the key ...
4
votes
1answer
240 views

Security of Even-Mansour scheme with keyed shuffle?

I was researching the Even-Mansour scheme and had a question that wasn't addressed in the paper that I saw, and google was minimally helpful. What if a permutation that uses secret data like the ...
0
votes
2answers
546 views

What characteristics define a function to be a block cipher

I'm trying to understand what characteristics or properties make the result of a function a block cipher. I understand that for a function to be a block cipher it has to be invertible and can't be a ...
0
votes
1answer
54 views

collision resistance with added permutation

Suppose we have an $n$ bit ciphertext $c$ protected by a $k$ bit $MAC$, with $k < n$. Generally, we expect collisions after $O(2^{k/2})$ ciphertext/MAC pairs are seen. Consider the following ...