Linked Questions

2 votes
2 answers
163 views

Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
0 votes
1 answer
99 views

Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
16 votes
3 answers
24k views

Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
1 vote
0 answers
65 views

Weaknesses of AES-GCM [duplicate]

Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES? I am creating a password vault and am trying to narrow down my options of encryption schemes. Also, is ...
14 votes
4 answers
9k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
0 votes
1 answer
79 views

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto According to wikipedia AES page, AES is a symmetric-key algorithm. The algorithm described by AES is a ...
0 votes
0 answers
90 views

Is it possible to uncover the plaintext if IV is used twice but the key is different?

I am currently working on a cryptography challenge. The program uses AES-GCM to encrypt and decrypt strings. Let's say I have the following: IV which is reused only 1 cipher text authentication tag ...
10 votes
2 answers
5k views

Changing an Encryption scheme from AES to ChaCha20

I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing. Now, how feasible it is to move from AES to ChaCha20? ...
12 votes
1 answer
3k views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
2 votes
1 answer
1k views

What does AES-GCM provide?

I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
4 votes
3 answers
779 views

Why is AES better than one-time pad?

From my limited research into this topic, it seems that AES can be brute-forced. One-time pad, on the other hand, cannot. Why then is it better to use AES than it is to use one-time pad? The only ...
0 votes
2 answers
1k views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
3 votes
2 answers
1k views

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include: Plaintext Ciphertext IV Algorithm (AES-GCM) In this case, will the attacker gain any ...
0 votes
1 answer
801 views

Alternative to CBC mode encryption?

Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ? a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
1 vote
1 answer
174 views

Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?

When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption? For easier ...

15 30 50 per page