Questions tagged [aes]
AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.
2,655
questions
0
votes
0
answers
22
views
AES-256 file encryption in c# [closed]
I recently needed to write a portion of code to encrypt file to AES-256 in C# language. Since I did not find ready implementations of it, apart of string encryption, and since I'm very far from ...
- 101
2
votes
1
answer
90
views
why there is a need to send iv with cipher text?
From what I understand by reading TLS 1.2 RFC (key calculation), PRF is used for this with the master key to derive the IV, so both side can generate the same IV because of the nature of PRF.
...
- 23
0
votes
1
answer
58
views
Encrypting AES-GCM Key with AES or RSA?
I am building an application with a hierarchy of key-sets (think encrypted messaging). Each key-set contains:
Symmetric (AES-GCM-256)
Asymmetric (RSA-OASEP-256)
Each key-set defines an encrypted &...
- 125
-1
votes
0
answers
42
views
SecureSWF Encryption
I have a problem regarding an swf file of an AS3 game. I intend to decompile the file in question, I am trying to open the file with JPEXS, but I am having some issues since the SWF file seems to be ...
0
votes
0
answers
36
views
Help with Hybrid Homomorphic Encryption
I read in this paper here that symmetric ciphers like AES is not a good choice for Hybrid Homomorphic Encryption due to large multiplicative depth. I want to understand more about this statement. How ...
- 19
0
votes
0
answers
37
views
Is it really safe to exchange data without a handshake?
I want to be able to exchange data between personal devices within a local network via HTTP.
The point is that I want to use the same pair of personal asymmetric keys on both sides. It turns out that ...
2
votes
1
answer
63
views
Attack on Even-Mansour on top of 10 rounds of AESENC
Consider a block cipher with 128-bit block and 128-bit key, built per the one-key Even-Mansour construction on top of a permutation consisting of 10 rounds of AESENC:
XOR the 16-byte input block with ...
- 144k
3
votes
2
answers
848
views
How do cache-timing attacks determine the secret keys of encryption algorithms?
In cache-timing attacks like prime+probe, attacking programs are able to discover the addresses of a victim program's data in main memory. These attacks are often used to determine the secret keys ...
- 33
2
votes
1
answer
79
views
Is AES-GCM safe if same key is used for both uplink and downlink, assuming last IV bit tells the direction
I have designed a cryptographical protocol which uses AES-GCM with a single key.
I have gone to great lengths to ensure the same initialization vector is never reused. The first bits of the ...
- 1,613
1
vote
0
answers
58
views
Do Curve448 shared secret need to be hashed?
I am planning to implement key agreement in an application, and Curve25519 offers the right properties for 128-bit security (AES-128). In a question I previously asked (Can Curve25519 shared secret be ...
- 1,613
6
votes
3
answers
878
views
Can Curve25519 shared secret be safely truncated to half its size?
I am planning to use a key agreement mechanism in an application needing ephemeral keys, and Curve25519 looks promising, specifically because it offers 128 bits of security, just fine for AES-128 ...
- 1,613
1
vote
1
answer
166
views
AES-CTR Mode, Predictability of Nonce
I'm trying to rebuild AES-CTR mode and have some questions concerning the generation of the nounce.
I've comonly seen the nonce be distributed like this $Nonce_{128\,bits} = IV_{64\,bits} \mathbin\...
1
vote
0
answers
107
views
Best way of using AES GCM with static key PBKDF2/HKDF
Refering to this thread : using different IV and SALT with AES-CBC but same KEY
I am in a similar situation to the one exposed, namely that I need to use AES to encrypt data, however, I cannot ...
- 31
1
vote
1
answer
71
views
What is the XOR count of AES MixColumn matrix?
I am a beginner and I am learning about XOR counts, (Link to background: https://ia.cr/2014/530).
The 4 by 4 matrix used in the MixColumn operation in AES is [2,3,1,1],[1,2,3,1],[1,1,2,3],[3,1,1,2]. I ...
0
votes
0
answers
60
views
How to find openSSL's AES T-table location for cache side channel attack
Let us assume I have a physically-indexed last-level cache, which is shared between the victim and adversary. Both the victim and attacker have their own copy of openSSL library in the caches. Victim ...
- 31
2
votes
1
answer
117
views
Why is the ciphertext output 32 bytes long when i encrypt a 16 bytes long plaintext by using AES-128-CBC
I am studying AES algorithm, as far as I know, encrypting a 16 bytes plaintext will result in a 16 bytes ciphertext. But I got a different result when trying to encrypt a 16 bytes plaintext using AES-...
- 21
0
votes
0
answers
53
views
How is the IV/Nonce determined in OFB mode? - SQLite Encryption Extension (SEE)
I am doing some research in different methods of encryption for SQLite databases. One of the databases I have is AES-256 OFB encrypted with SEE (https://sqlite.org/see/doc/release/www/readme.wiki). ...
2
votes
1
answer
179
views
AES vs Serpent - which is more side-channel resistent?
I learned that some AES implementations are vulnerable to side-channel attacks due to how the SBOX structure is implemented. The output have to be nonlinear, therefore having low bit inputs results in ...
- 43
1
vote
1
answer
175
views
How to generate 24 bytes CMAC using AES-192 or AES-256
Is it possible to generate a 24 bytes CMAC using AES-192 or AES-256 and if so, how?
According to AN10922AN10922.0df,looks like we can generate 24 bytes and 32 bytes key using div constant ?
- 11
1
vote
0
answers
64
views
Test data for AES based F8 encryption, F9 authentication
I am working on implementation of F8 confidentiality scheme for encryption/decryption and F9 based authentication scheme. These are specified by 3GPP standard, but the implementation in standard is ...
- 11
1
vote
0
answers
66
views
crack AES CBC with chosen Ciphertext, IV and known plaintext [closed]
I am currently tackling a challenge involving AES CBC encryption where i have the ability to choose both the IV and the ciphertext, and then provide it to a service. The service decrypts with an ...
- 11
1
vote
0
answers
76
views
New Impossible Differential Attacks on AES reduce time complexity
I am interested in the following snippet from the paper New Impossible Differential Attacks on AES.
Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack
The most time consuming steps of ...
- 41
2
votes
1
answer
69
views
Is AES-CTR mode with predictable IV vulnerable to CPA attacks?
I'm just confused about this topic problem.
I know that the CBC mode will be vulnerable to CPA attacks if the IV is predictable, but what about the CTR mode?
3
votes
1
answer
138
views
Is using KDF more insecure that generating key directly? (AES 256 CBC)
I am writing a PHP application that requires files to encrypted using AES-256-CBC.
I have two options:
Option #1
Generate a totally random AES key => User Key
Generate another totally random AES ...
- 33
0
votes
1
answer
61
views
Difference between AES-128 FIPS-197 & AES-128 CBC workflow
For a single block of 16 bytes...
The following is the workflow of AES-128 FIPS-197 which produces the correct output using NIST test vector from page 35:
...
- 152
2
votes
0
answers
53
views
Design criteria of block ciphers in quantum setting
Some design criteria of block ciphers are already known for the resistance against known attacks like differential, linear , boomerang, etc. Does there already exist any study of design criteria of ...
- 31
1
vote
1
answer
108
views
When using AES, is doing encryption followed by decryption with the same key efficient?
It seems that rekeying between block cipher calls of AES is expensive. Meaning that calling $AESenc(K_1,M_1)$ and then calling $AESenc(K_2,M_2)$ with $K_1 \ne K_2$ is slower than calling $AESenc(K_1,...
- 55
0
votes
1
answer
47
views
Authenticate with roles without a server
Introduction part
I'm writing an application that requires authentication to be used, specifically the database and config file can only be read an authenticated user. However this authentication is ...
- 101
1
vote
1
answer
214
views
Statistical differences between ciphertexts generated by AES in ECB vs CBC mode?
Given two ciphertexts encrypting the same (natural language) plaintext, where we know that one of the ciphertexts was encrypted with AES-CBC (and unknown IV) and one was encrypted with AES in EBC mode,...
- 113
1
vote
0
answers
19
views
Understand Putty ppkv3 flow
I asked a question yesterday about how the ppk file is generated. I got the answer but how can I derive the aes key and the IV? For example by using CyberChef?
I have the passphrase and the salt, how ...
- 123
1
vote
1
answer
151
views
Putty PPK Encryption Questions (or AES-CBC)
I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
- 123
2
votes
0
answers
58
views
How Helpful is NXP's LRP Encryption Protocol vs AES for short keys?
NXP has a custom (I think) encryption protocol known as "Leakage-Resistant Primitive", or LRP, built on top of AES. I think the goal of this is to basically "expand" the length of ...
- 121
0
votes
1
answer
124
views
Row level database encryption scheme
I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online.
My primary concerns are:
...
- 1
2
votes
2
answers
202
views
Key Exhaustion Risks in Symmetric and Asymmetric Cryptography
For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk.
Curious to know whether the asymmetric key ...
- 123
1
vote
0
answers
100
views
Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c)) $ used multiple times with low bit keys $k$. Avoids MitmA?
More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a
Xor key obfuscation $k'$ with ...
- 453
1
vote
1
answer
65
views
Can two different AES keys have the KCV by chance?
I am trying to check KCVs of a few keys.
I am generating the KCV for the keys using the method mentioned here https://crypto.stackexchange.com/a/11873/115990
Question: Can KCVs of two different AES ...
- 113
0
votes
2
answers
70
views
How does MixColumn collapse 4 active S-boxes into 1?
In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns:
I'm trying to reproduce these paterns.
The pattern in the column marked in ...
- 101
0
votes
0
answers
20
views
Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models
In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered.
Typically, security proofs for cryptographic modes ...
- 1
1
vote
0
answers
79
views
When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?
If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
- 197
2
votes
1
answer
188
views
Using AES-CBC with a random number plus a counter for the IV
I understand that AES-CBC uses the following scheme for encrypting data (diagram from Wikipedia):
And, I understand that we don't want initialization vectors to be predictable or constant, and also ...
- 123
0
votes
1
answer
80
views
Can I prove AES-GCM nonce reuse just from the bytes?
I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
- 1
5
votes
1
answer
288
views
New NIST Journey: Accordion Cipher Mode
NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
- 2,268
1
vote
1
answer
325
views
AES-128 ECB Standard Confusion
Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing.
To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
4
votes
2
answers
637
views
Utilizing block cipher (AES) while saving bandwith
I'm helping a company to redesign their cryptographic protocol for communication within a network of embedded devices.
So far I have discovered several insecure practices, such as using very short (6 ...
1
vote
2
answers
74
views
App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure
I have this uni project that I have to implement in code:
"App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
3
votes
1
answer
735
views
Is AES a group?
The question I'm wondering is whether the AES cipher is a closed cipher (which is equivalent to AES being a group). And this question interests me due to the lack of understanding of whether it is ...
- 53
1
vote
0
answers
25
views
Using longer key with PKCS#5 derive_key() function for AES256? [closed]
I have code where someone made the key 64 bytes (32*2) and passes to the derive_key() function. It then uses the key created for ...
- 133
0
votes
0
answers
33
views
Is it possible for a given plaintext and ciphertext to have two different keys? [duplicate]
This has probably been asked before but for a given ciphertext and plaintext pair, is it possible to have two different keys producing said pair? Or there are no collisions in AES, unlike hashing ...
0
votes
1
answer
105
views
Do I need to use unique IVs if all encrypted data is unique?
I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
- 103
0
votes
1
answer
399
views
Encrypting the nonce in AES-CCM
I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
