Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
4 votes
3 answers
156 views

Why is AES better than one-time pad?

From my limited research into this topic, it seems that AES can be brute-forced. One-time pad, on the other hand, cannot. Why then is it better to use AES than it is to use one-time pad? The only ...
0 votes
1 answer
38 views

Reduce AES-CTR malleability impact by shuffling plain text

I need to cipher and decipher text with randomly access. For this I decided to use AES in CTR mode which is a good compromise between CBC and GCM. But CTR mode is malleable. It is not a big problem ...
0 votes
1 answer
25 views

MOSH - Decrypt session when the shared secret is known

Currently I'm working on an intercepting proxy server for mosh connections. I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
0 votes
1 answer
49 views

Can one infer concatenated ciphertext block boundaries through digital forensics?

Say one encrypts multiple plain text blocks with same IV but different keys using AES-256-CBC, can one infer concatenated ciphertext block boundaries through digital forensics? Example Plain text ...
2 votes
1 answer
67 views

Clarification on expected number of plaintext, ciphertext pairs needed to identify AES keys

I'm aware of the many questions on this topic, but I'm still not sure what went wrong with my reasoning here below. I'm assuming use of AES with key size $2^{256}$ and messages of size $2^{128}$, ...
  • 311
2 votes
3 answers
1k views

Is there a security risk to use AES-CBC as stream cipher?

I am building a chat application where I want to encrypt each character while they are typing. I would require a stream cipher for that. I am planning to use AES-CBC mode with HMAC. Are there any ...
0 votes
0 answers
38 views

Is AES-256-CBC secure in the context of offline encrypted backups?

My understanding is that AES-256-GCM is more secure given it supports authentication. Also, my understanding is that AES-256-CBC is vulnerable to “chosen-plaintext”, “chosen-ciphertext” and “padding ...
0 votes
0 answers
56 views

Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?

I know this is theoretically bad practice, but please bear with me… Assuming following spec: Salt and IV are randomly generated using cryptographically-secure RNG. Argon2 is used as KDF so ...
0 votes
2 answers
95 views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
0 votes
1 answer
36 views

How easy is it to identifiy the key when knowing a certain number of different AES-256/Fixed Nonce encrypted long-integers

Given some intervals of long integers (64 Bits). I need to generate alphanumeric strings which: should be used like passwords(known only by few individuals) must always be the same for the same ...
  • 111
0 votes
0 answers
33 views

How LastPass decrypts database on web browser?

According to video from Dr. Pound, password managers (LastPass in particular) holds encrypted image of your data on their servers and then with master password you authenticate to get encrypted image ...
  • 101
1 vote
1 answer
63 views

Is it possible to use aes-ecb-256 decryption algorithm as customer key derivation function to generate the aes key?

I'm sorry if I'm going horribly wrong - I am new to this stuff. My question is: KDFC1,KDFC2,KDFC3 is defined by myself. Key1 is come from outside . Is it possible to use the aes-ecb-256 decryption ...
  • 11
-1 votes
1 answer
40 views

AES authoritative recommendations?

I am trying to figure out if there is an authority like FIPS, NIST, NSA, or DOD that has recommendations or standards for implementing AES such as key derivation algorithms and iterations as well as ...
  • 29
0 votes
1 answer
49 views

What's the security of AES-CBC encrypt then MAC on the client side?

What if a software is open source or the software itself promotes it uses AES CBC or being guessed bruteforcely. Attacker will have the exact algorithm that this example downloaded encrypted ...
0 votes
1 answer
60 views

How is AES-GCM IV and auth tag used?

I have been learning about AES-GCM and AES in general lately and founding: The key is the secret and both sender and receiver keep it hidden forever. The IV and auth tag are public and sent along with ...
0 votes
1 answer
115 views

Should I use hash of passphrase as AES256 key

As title I have a password-like passphrase (8 chars at least) that is then hashed with argon2(with the salt is SHA256 of that passphrase). Then use it as AES256 key along with a random IV generated by ...
-1 votes
1 answer
114 views

What is the importance of superencryption?

Please, can any extensively explain the importance of super encryption in relation to attacks experienced by single standard algorithms
0 votes
1 answer
101 views

How is Diffie-Hellman linked to AES?

I have just learnt about Diffie-Hellman and AES. However, I cannot seem to understand how they link. My initial idea was that Diffie-hellman is used to transfer a key for AES decryption. After further ...
  • 3
0 votes
0 answers
43 views

AES mode for decrypting a file in chunks

I have a use-case where I need to encrypt some binary data, which may not be 16 byte aligned, and save it for consumption later. When the data needs to be consumed, the encrypted data is sent over to ...
  • 101
0 votes
0 answers
21 views

AES with a different implementation [duplicate]

suggested a new implementation for AES:byte substitution step will be replaced by a function that cyclic shift of one bit to the right instead the regular implementation of AES. How does this change ...
  • 1
3 votes
1 answer
618 views

AES with a different implementation of byte substitution step

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me: suggested a new implementation for AES: The byte substitution step will be ...
  • 31
1 vote
1 answer
70 views

best encryption algorithm for encrypting a string

I am making a password manager , I am new to cryptography, so , can someone tell me if this can be a good solution? 1- the user inputs the email/password 2- all the payload gets encrypted with aes@...
0 votes
1 answer
58 views

GnuPG - provide encryption key for AES rather than deriving it from passphrase

I'd like to encrypt a file with AES256 and provide my own 32-bytes for the encryption, rather than having GPG derive it from the passphrase. I could not find such option, but I'm thinking about a ...
-1 votes
1 answer
118 views

AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]

Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
  • 109
2 votes
2 answers
65 views

How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
2 votes
1 answer
93 views

Byte-Serial implementation of AES

I am trying to make a byte-serial implementation of the AES 128-Bit in ECB-mode for my studies. I understand the "normal" (word-parallel) implementation of AES and the way of Eli Biham (bit-...
0 votes
1 answer
73 views

Encrypting a document with 2 different keys

Is there a way to encrypt a file with 2 (or more) keys and then access it with only 1? Scenario: Bob and Alice have a tight memory and can only remember ONE key. Bob and Alice encrypt a file with ...
1 vote
1 answer
167 views

Does a self-build random 256-key based on substition and permutation have the same power as an AES-key?

As far as understand AES takes 16 bytes, shuffles them and replaces every of the 256 bits via XOR. Then the same procedure applies to the next 16 bytes, and then again - until the entire file is ...
0 votes
1 answer
65 views

pros and cons of cryptographic session token

I designed a simple library (golang) for use as session token for web applications. The idea is simple: the token will be 16-byte long, denote it as t generate a ...
  • 137
4 votes
1 answer
247 views

What does "key version" refer to when talking about AES 128 in NXP's datasheet?

I'm going through the datasheet for MifareDesfire ICs. Throughout the document, there are mentions of "key version". For example, section 9.3 of the document states: Hardware AES using 128-...
  • 143
4 votes
0 answers
107 views

Why Block Ciphers

I​ fail to understand what block ciphers can do that stream ciphers cannot. Also aren't they construct able from one another. prg(stream cipher) -> prf -> prp(block cipher) Any practical example ...
  • 41
1 vote
1 answer
190 views

How does AES GCM encryption work

Previously, I used AES CBC 256 with 256 bit key and 128 bit IV. However it seems slow so I decide to switch to AES GCM 256 bit key, 96 bit IV which has some parts I don't understand such as: Auth tag:...
0 votes
0 answers
100 views

Which block cipher modes of AES-256 are quantum safe? Is OCB mode quantum safe?

I was wondering if I have to keep my data safe in an age when quantum computers become a reality. Which AES block cipher modes will be secure? Will AES-OCB will be quantum safe if used in a PGP like ...
0 votes
1 answer
94 views

What is the lightest cipher that provides AES like security?

The lightest, or fastest cipher, that is well known and quite secure like AES. Is ChaCha20 a good option? Are there any better alternatives that are faster but still as secure?
1 vote
1 answer
211 views

XChaCha20 vs AES 128 security and speed

Is XChaCha20 with 256 bit key and 192 bit nonce more secure than 128 bit key 128 bit key nonce AES, due to using larger key/nonce sizes? Isn't it supposed to be faster due to being a stream cipher? (...
0 votes
1 answer
32 views

Randomness of recursive sequence generation

How good from randomness point of view are recursively generated sequences using good encryption algorithms? Let us say I take AES128 which generates good random sequences of outputs for counter ...
0 votes
0 answers
38 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
3 votes
1 answer
86 views

AES-GCM with different IVs but close enough for counter to cause duplicates

I am planning to use AES-GCM or AES-CTR for encryption. However, I have read from several sources that the IVs must be unique for every piece of information encrypted. I have a doubt though, what if I ...
1 vote
1 answer
469 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
1 vote
1 answer
65 views

Do snapshots of Encrypted Disk Images weaken security?

I have read/write disk images encrypted with 128 AES using Mac's disk utility. If I snapshot the encrypted disk images daily (sometimes with changes other times without), and an attacker has access to ...
0 votes
1 answer
75 views

Mix Columns in AES cryptography Algorithm

Hi I am totally new to cryptography. This paper [1] was explaining the mix columns. But at a point I am not understanding the calculation. F2 * 03 = F2 *02 + F2 * 01 = 1111 0010 *02 = 11100101 XOR 1B =...
0 votes
1 answer
64 views

Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?

I want to store two ciphertexts inside the same file. The data stored in each ciphertext is the same (except for padding), but the data was encrypted with different keys and IVs. Both ciphertexts were ...
  • 3
3 votes
1 answer
123 views

Key Committing AES-GCM

There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/...
1 vote
1 answer
85 views

Is it safe to "compress" an IV in AES256-CTR? [closed]

Alice is using AES256 in CTR mode to send encrypted messages to Bob. The messages are 4 byte values. Along with each encrypted message, Alice sends along a random 16 byte IV. ...
2 votes
2 answers
122 views

What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?

I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03. According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
1 vote
2 answers
66 views

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

From RFC 5246, section 6.2.3.3: AEAD Ciphers: AEAD ciphers take as input a single key, a nonce, a plaintext, and "additional data" to be included in the authentication check, as described in ...
  • 49
3 votes
1 answer
187 views

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

As per my understanding that the nonce of AES-GCM in SSL has 3 parts: . salt, 4 bytes, generated in handshake, not changed in whole session . nonce_explicit, 8 bytes, chosen by the sender and ...
  • 49
1 vote
2 answers
105 views

Faster cipher than AES256-CBC to use for DRM purpose

I have to develop a program using a "secret" locally stored encoded program for a school project. For this I have to decipher the code on the fly to use it. The project recommend the use of ...
1 vote
1 answer
114 views

What's the best way to recover an AES-256 key from partial key, ciphertext, plaintext and IV?

So I'm trying to decrypt AES encryption with a 32-byte key. I know the first 7 bytes, and the final 19. I also have the plain text, as well as the IV and the encrypted text. I'm currently running ...
0 votes
0 answers
41 views

Is it possible to get partial plaintext when using the wrong key with AES-256 [duplicate]

I have a scheme where a key and a data blob are provided that I need to decrypt. I do not know if the key provided is correct and I want to throw an error in my system if the wrong key is used. I get ...
  • 101

1
2 3 4 5
49