Linked Questions

16 votes
3 answers
24k views

Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
Offir's user avatar
  • 283
45 votes
2 answers
38k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
Hendrikvh's user avatar
  • 553
19 votes
5 answers
4k views

AES GCM : is it acceptable to return the wrong plaintext if the tag is incorrect?

Let's start by saying I'm no cryptography expert, I'm just a developer, so feel free to correct me (using words, not downvotes) if what I'm saying is non-sense. Context: I'm doing some crypto as a ...
ShellCode's user avatar
  • 293
25 votes
2 answers
23k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
Matteo Monti's user avatar
  • 1,417
13 votes
1 answer
3k views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
Expectator's user avatar
14 votes
4 answers
9k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
hanshenrik's user avatar
4 votes
2 answers
3k views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
Abra Cadabra's user avatar
15 votes
2 answers
2k views

Does GCM (or GHASH) only provide 64-bit security against forgeries?

In a recent comment a doubt was voiced about my answer, which claims GCM to requires $2^{128}$ for a successful forgery. The doubt was that the square root needs to be taken meaning the security would ...
SEJPM's user avatar
  • 46.2k
10 votes
2 answers
5k views

Changing an Encryption scheme from AES to ChaCha20

I am using the AES cipher for my OTT platform. Almost all Chip vendors (ARM, Intel, etc) have built-in AES for faster and secure processing. Now, how feasible it is to move from AES to ChaCha20? ...
SSA's user avatar
  • 640
6 votes
2 answers
4k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
kelalaka's user avatar
  • 49k
3 votes
2 answers
6k views

So is AES-256 more secure or less secure than AES-128 after all?

It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...
Hormoz's user avatar
  • 799
4 votes
3 answers
2k views

Designing a secure UDP-based communication protocol

SUMMARY UPDATE: I have changed the title of this question from "Using an encrypted packet counter as a counter value in AES-CTR" to "Designing a secure UDP-based communication protocol&...
Samuel Moriarty's user avatar
3 votes
2 answers
5k views

What is a good AES mode to use on file encryption?

I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex ...
user63579's user avatar
4 votes
3 answers
787 views

Why is AES better than one-time pad?

From my limited research into this topic, it seems that AES can be brute-forced. One-time pad, on the other hand, cannot. Why then is it better to use AES than it is to use one-time pad? The only ...
Hera Sutton's user avatar
3 votes
2 answers
1k views

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

Say, for an AES-GCM encryption, an attacker knows essentially everything except the key. This would include: Plaintext Ciphertext IV Algorithm (AES-GCM) In this case, will the attacker gain any ...
Erik Hermansen's user avatar
2 votes
2 answers
413 views

Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
Evan Su's user avatar
  • 449
2 votes
2 answers
567 views

With AES-CTR does the block input need to be implemented as nonce || counter?

I am looking at an AES-CTR implementation (WebCrypto) and it takes an initialization parameter count which is an array of 16 bytes. It then asks you to specify <...
Chris_F's user avatar
  • 197
5 votes
1 answer
768 views

The Rationale behind NIST's counter/LFSR recommendation on deterministic IV constructions on SP 800-38D

The NIST has a "SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC". This guideline is a base for AES-GCM from definition to security ...
kelalaka's user avatar
  • 49k
0 votes
2 answers
1k views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
Kim Mỹ's user avatar
  • 165
2 votes
1 answer
1k views

What does AES-GCM provide?

I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
CryptoGuru's user avatar
0 votes
1 answer
815 views

Alternative to CBC mode encryption?

Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ? a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
Ravindra HV's user avatar
2 votes
1 answer
873 views

AES CTR - Counter Management

Let ssuppose that we are using AES in CTR mode to encrypt a number of blocks ($x$ bytes each). How is the current used IV (nonce+ctr) synchronized among both communicating entities? I suppose that the ...
Marc's user avatar
  • 317
2 votes
2 answers
837 views

How much data can we encrypt using AES 256 before changing the key?

Although this question has been answered in this link (After How Much Data Encryption (AES-256) we should change key?), I am not satisfied with the answers because the Recommendation for Block Cipher ...
user48217's user avatar
0 votes
1 answer
838 views

Consequences of AES-GCM always encrypting the same plaintext

I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages. Regarding the authentication protocol, I made the following observations: The plaintext ...
Kobodjo's user avatar
  • 31
2 votes
2 answers
169 views

Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
Bhuvan's user avatar
  • 123
1 vote
2 answers
509 views

Is it cryptographically insecure to use fixed-length AES-GCM messages?

Is there any weaknesses to encrypting fixed-length messages? Should a random amount of padding be added to the message to decrease the odds of some sort of attack?
user avatar
0 votes
1 answer
649 views

Is a random string good for an AES-256 instance

I have a randomly generated string of about 256 characters long. This string is hashed to for a key and initialization vector for a program running on the .NET framework 4.8. Is this method secure ...
DDX5 Media's user avatar
1 vote
1 answer
176 views

Do I need to change IV in AES-256 GCM when I only use encryption for challenge-response exchange with random string?

When I want to use encryption only for challenge-response exchange and not for hiding the contents of an encrypted message, is it still a threat to me not changing IV for new encryption? For easier ...
krystof18's user avatar
  • 143
1 vote
1 answer
130 views

Why are iterated substitution-permutation product ciphers only used on fixed-size plaintext blocks?

Another way to ask this question: when block ciphers were invented, why did they add the restriction that the block cipher would be restricted to blocks of a fixed size? From my laymen's point of view,...
Wladston Ferreira Filho's user avatar
0 votes
1 answer
99 views

Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
Ryan Hilbert's user avatar

15 30 50 per page