Linked Questions
12 questions linked to/from Is CTR more secure than CBC?
421
votes
13
answers
184k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 86.6k
39
votes
3
answers
47k
views
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
- 491
17
votes
1
answer
27k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 311
13
votes
4
answers
8k
views
Disadvantages of AES-CTR?
On paper, it sounds *very* good to me:
secure
fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
- 487
10
votes
3
answers
13k
views
How to break AES/CBC/PKCS5 when key and IV are reused?
I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
- 101
5
votes
2
answers
3k
views
During padding oracle attack (CBC), how is first byte of plaintext block is obtained?
Imagine conducting a padding oracle attack against CBC mode with 16-byte length blocks, and PKCS#5 used for padding.
You start, as always, revealing the last byte of plaintext. Then you iteratively ...
- 51
3
votes
2
answers
4k
views
What is a good AES mode to use on file encryption?
I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex ...
- 31
8
votes
1
answer
814
views
Cipher suites: same name, different IDs, why?
Sorry if I missed with a community to ask.
Recently I stumbled on a fact that the same cipher suite can be designated by two different IDs, and this is not a typo nor single occasion.
For instance:
...
- 183
4
votes
1
answer
809
views
Why are block ciphers mostly used as stream ciphers?
Using a block cipher with using either CTR or GCM mode gives us a stream cipher, the only difference being that CTR does not include a MAC tag or AAD but GCM does. I think these are the most commonly ...
- 236
3
votes
1
answer
1k
views
What is the maximum number of messages that can be encrypted using the same key for CTR mode?
In the counter mode of encryption, the nonce cannot be used again unless a new block cipher key is chosen. What is the maximum number of messages that can be encrypted using the same key?
The maximum ...
- 43
2
votes
1
answer
1k
views
Is CTR really equally secure than CBC?
Here is a typical cryptographic situation:
A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
- 187
0
votes
0
answers
830
views
Is OpenSSL enc using AES-256-CBC to encrypt large files safe?
I first generate a keyfile with openssl rand -hex 64 -out keyfile.
I then encrypt the file with ...
