Questions tagged [aes]
AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.
2,585
questions
-1
votes
0
answers
18
views
Are there any obvious vulnerabilities/flaws in my secure communications scheme, specifically in the way I use sequence numbers in messages? [closed]
Sorry, this is a long question, but I wanted to give proper background.
QUESTION:
Are there any obvious vulnerabilities/flaws in my secure communications scheme. Most specifically I want to find ...
- 131
1
vote
0
answers
75
views
Can the requirement to increase rounds with key size be bypassed?
When taking AES for example, the number of rounds increases as the key size increases.
This is done in order to adequately diffuse key bits into the state of the cipher.
Suppose you replace the AES ...
- 169
0
votes
1
answer
102
views
Does using multiple encryption algorithms with different keys on the same cipher text improve security?
I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
0
votes
1
answer
95
views
How to evaluate the minimum complexity of the key recovery when the success probability p is given？
Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques.
My problem is that could we ...
0
votes
0
answers
122
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
0
votes
1
answer
102
views
Advantages of AES vs XOR on a plain text file
Currently, I am using AES-GCM to encode and decode a plain text file. The key is derived from a plain text password using PBKDF2 and a random salt with SHA-256. However, I have been thinking and came ...
- 1
1
vote
1
answer
97
views
Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?
This is a follow up question to:
Bit Flipping Attack on CBC Mode
which demonstrates that a bit flipping attack with a known IV is possible on CBC mode.
Is it safe to assume that the bit flicking ...
user112328
1
vote
0
answers
65
views
Weaknesses of AES-GCM [duplicate]
Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES?
I am creating a password vault and am trying to narrow down my options of encryption schemes.
Also, is ...
- 11
0
votes
0
answers
22
views
Decrypting AES-128 with known regularly spaced single byte value [duplicate]
How would knowing a clear byte value of the decrypted data affect a brute force attack on an AES-128 encrypted message ?
i.e. If I knew the 1st byte should decrypt to 0xff
OR I knew that every 100 ...
- 1
0
votes
0
answers
99
views
AES-GCM with a fixed IV but a random "wrapped" key
It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
1
vote
2
answers
193
views
Hamming Distance and Avalanche effect in Cryptography?
I am new to Cryptography and I know there are better ways to test a cipher's effectiveness out there but in this case I am trying to test a cryptographic algorithm's(AES,xchacha20,twofish) hamming ...
- 43
0
votes
0
answers
50
views
AES-ECB attack encryption audio fie
I got two audio files one is encrypted and the other file is a part of the plaintext. I want to extract all the plaintext. I am using the AES-ECB mode, the size of the block is 128 bits and the start ...
3
votes
1
answer
249
views
Is there any way to measure entropy of encryption algorithms in python?
I am new to cryptography and I am trying to find a way to measure ciphertext entropy of encryption algorithms such as AES, Chacha20, etc for a school project. Is there any way to do it on Python? I ...
- 43
0
votes
0
answers
38
views
How to make sure that $S$ & $S^{-1}$($S$ inverse) is a permutation of bytes?
Assume you have implemented the S-box and Inverse S-box of AES as code (or hardware) instead of a lookup table copy-pasted from the AES standard. An obvious test you want do is to check that S−1(S(B)) ...
- 1
0
votes
0
answers
29
views
Writing a specific position of AES state in a specific round in terms of Key bytes
Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
1
vote
1
answer
83
views
Is it possible to use two different engine to encrypt/decrypt data with AES GCM?
I'm confused about something that makes AES GCM great.
It uses MAC to sign data it encrypts. I also uses nonce.
But lets say I encrypt data in software A. Software A produces a ciphertext and a tag as ...
- 11
0
votes
1
answer
56
views
Nonce reuse in GMAC without ciphertext (only AAD)
As we all know, nonce reuse in AES/GCM can easily be catastrophic.
However, I'm wondering if the same risks are present if an adversary has access to:
Ciphertext and corresponding MAC of one message
...
- 101
1
vote
2
answers
3k
views
How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?
Respected community,
I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker.
Is it easy ...
- 1,000
2
votes
1
answer
130
views
AES GCM iv/nonce length under 12 bytes in java [duplicate]
I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes ...
0
votes
1
answer
55
views
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto
According to wikipedia AES page, AES is a symmetric-key algorithm.
The algorithm described by AES is a ...
- 101
0
votes
0
answers
40
views
Java AES T-Tables Implementation
I am trying to implement an encryption function that uses the AES T-Tables implementation.
I am quite sure that my roundKeys are correct.
I also know that the initial round key addition in the ...
2
votes
3
answers
532
views
Check if encrypted text is equal without decrypting or doing heavy calculation - AES
I implemented AES128-CBC algorithm and what I need is to be able to compare encrypted text without decrypting. Is the only way to use static or no iv to achieve this? . Any ideas?
Use in code -...
- 23
0
votes
0
answers
41
views
2 XORed AES-ECB ciphertexts, zero key and piece of plaintext
I have $C_1 \oplus C_2$ where $C_1$ = $AES128_k(P_1)$ and $C_2$ = $AES128_k(P_2)$.
I know the k, it is 0 (i.e. 16 bytes of zeros).
I know the piece of $P_1$ (7 ...
- 1
1
vote
1
answer
57
views
DDT for boolean functions must contain only powers of two
I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
2
votes
2
answers
378
views
Obsidian.md's "end-to-end" encryption & privacy
Obsidian.md claims
End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
- 21
1
vote
1
answer
123
views
What is the probability of decrypting AES-128-ECB if some of the information is available?
There is a JSON array like this:
...
- 11
0
votes
0
answers
40
views
Implementation of Ring Signature
I have implemented a ring signature in a Python program, To keep it simple, I have Alice and Bob. Based on this ring equation:
$$ v = E_k(y_s⊕E_k(y_i⊕v))$$
I will get:
$$ y_s = E_k^{-1}(v)⊕E_k(y_i⊕v) \...
- 11
1
vote
1
answer
40
views
Does any encryption/decryption algorithm supports linear decomposition?
I am not sure whether "linear decomposition" is appropriate to summary my question: We know that the traditional symmetric encryption/decryption algorithm (like AES, TDES) can be written as:
...
- 13
1
vote
1
answer
63
views
Newbie question about AES-GCM and IV
Imagine a channel where the initial secret for deriving of the actual key is established with ECDH.
First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
- 113
0
votes
1
answer
68
views
How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?
I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data.
It's a black box challenge, but managed to figure out the ...
- 173
0
votes
1
answer
45
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
0
votes
1
answer
142
views
Some questions about AES-128 key wrapping using RFC3394
It's that time of the year - I'm trying to learn how AES-128-CBC encryption works. My key is (since it's AES-128) is 16 bytes, my IV is 16 bytes as well. My implementation of key wrapping does ...
- 173
0
votes
1
answer
141
views
How does the Key Expansion Step Work for AES-192
I now understand the initial key from all the round keys will be the original 4x4 block for 128-bit keys, but I do not know how it would work for something else, like AES-256 or 192. Would it be that ...
2
votes
1
answer
137
views
Can I predict CryptGenRandom on my own device?
I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia:
Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
- 221
1
vote
2
answers
275
views
Encrypting random IV in CTR mode (no nonce!)
Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
- 323
2
votes
1
answer
109
views
Is it possible to reverse engineer an encryption algorithm derived from AES-128 given these conditions?
Given the following conditions:
The encryption program, which uses some algorithm resembling AES-128 but with unknown modifications to real AES-128.
It uses a fixed key and IV.
It is written in Rust ...
- 173
2
votes
1
answer
463
views
CTF - AES Padding Oracle [closed]
I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
- 145
2
votes
1
answer
186
views
What is the correct way to use HKDF with X25519?
I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF.
Initially, I ...
- 31
0
votes
0
answers
8
views
LoRa Cloud PIN derivation according to 'smtc0' algorithm
I am following the steps in LoRa Cloud in order to derive the PIN value using the Algorithm smtc0 (https://www.loracloud.com/documentation/join_service?url=derivation_schemes.html).
I don't quite ...
3
votes
1
answer
259
views
Weird padding in Crypto.Util.Padding.pad() function in python
I'm trying to pad some plaintext to be a multiple of 16 bytes to use it as input in AES ECB block cipher.
...
2
votes
2
answers
102
views
Recommended way to generate a key and IV for CFB mode?
I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
0
votes
0
answers
500
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
0
votes
0
answers
53
views
Hybrid encryption parameters when using elliptic curve keys
I wrote a command line application for encrypting/decrypting files to your local machine. The idea is you have an asymmetric key pair where the private key is stored encrypted and the public key is ...
0
votes
1
answer
96
views
Has AES some keys which are related to each other? e.g. $\forall m: AES(AES(m,k1),k2)=AES(AES(m,k2),k1)$ or $AES^n(m,k1)=AES(m,k2)$. How to find them?
Do $\exists $ keys $k_1, k_2$ which given any (128-bit) message $m$ are related to each other by being
commutative to each other with $AES(AES(m,k_1),k_2)=AES(AES(m,k_2),k_1)$ $\forall m$ and ...
- 573
0
votes
2
answers
88
views
AES security: how many rounds we need to fall the differential probability below 2^(-128) in the case of that branch number is 3
In AES, the MixColumns operation involves a linear transformation from GF(2^8)^4 to GF(2^8)^4. The branching factor for this transformation in the original AES is 4, and it is considered secure ...
2
votes
0
answers
49
views
Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?
I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
- 21
0
votes
1
answer
25
views
AES GCM representation of lev(IV) in IV padding to compute ICB
I have a question regarding understanding representation of length in AES-GCM while doing padding for the IV to calculate ICB/J0.
In the aes GCM test vectors testcase5 I see the IV is of length 8 ...
- 357
0
votes
1
answer
67
views
1
vote
1
answer
43
views
DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?
It is DTLS 1.2 version question of this question.
I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2.
In TLS 1.2
AAD = seq_num + ...
- 13
1
vote
1
answer
219
views
How does AES-GCM and AES-CCM provide authenticity?
My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity.
In CCM, as I understand it, the authenticity lies in the MAC, i....
- 11