Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

0
votes
0answers
33 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
-1
votes
0answers
35 views

AES decryption algorithm [on hold]

I'm quite new to Cryptography. How does the decryption work for AES? We know that it implements encryption using confusion and diffusion technique, how does it work for decryption?
14
votes
3answers
4k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
5
votes
1answer
3k views

Should AES.decrypt(ct, wrong_key) return blank or wrong result?

I am trying to use AES as cipher for an application I am building. I am using a JavaScript library (https://code.google.com/p/crypto-js/) to perform encryption and decryption with AES. When I ...
3
votes
4answers
2k views

What is stronger Threefish 1024bit, SHACAL-2 512bit or AES 256?

I found some App in Google Store, and there were features only for PRO version: Threefish 1024bit, SHACAL-2 512bit. Meantime AES 256 was available in free version of app. So I concluded that ...
2
votes
2answers
130 views

What is a good AES mode to use on file encryption?

I'm new to encryption and cryptography, I was wondering if there is a good or best suited AES mode for file encryption (Planning on zipping a folder and encrypt it as a file). If there is, how complex ...
2
votes
1answer
333 views

Why is Byte-at-a-time ECB decryption a vulnerability?

I've been working on the Cryptopals Cryptography challenge problems, and I recently solved one where you recover a plaintext given a encryption oracle. The oracle produces a ciphertext in ECB mode AES....
-1
votes
0answers
31 views

AES-CTR mode using different key's generated trough PBKDF2 in case at least two IVs repeat

Supposed that a client has AES-128 bit randomly generated static key The client is using a PBKDF2 in order to to generate a vector(list) of keys i.e. target keys to leverage will be located ...
6
votes
2answers
265 views

Password derived hash to encrypt known plaintext as password check

The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if ...
3
votes
2answers
478 views

Can AES be used with a static key?

I am making an embedded system for a project that uses AES. As I cannot accommodate key generation (hardware constraints) I am using a static key. I can use another small algorithm to create dynamism ...
3
votes
1answer
161 views

AES process candidates implementations and usages

There were fifteen candidates in the AES selection and I suppose that Rijndael wasn't the single good algorithm. I know that Camellia is an evolution of E2 candidate and can be used as symetric ...
45
votes
2answers
91k views

What is safer: ZipCrypto or AES-256?

Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
1
vote
2answers
52 views

Why can´t an attacker find the key if he has the plain text, the IV and the ciphertext? [duplicate]

I am reading a book about web security and they are now talking about AES CBC. After reading the chapter I was wondering, can an attacker compute my secret key if he has access to the IV, the plain ...
1
vote
1answer
37 views

Key, plaintext block and ciphertext block permutations question

Question: If a cipher’s key size is $k$ bits and its block size is $b$ bits, how many possible keys are there, how many possible plaintext blocks are there, and how many possible ciphertext blocks are ...
1
vote
1answer
37 views

With AES-GCM, may I use multiple tags per key?

In my implementation of AES-GCM, the key might change only once per minute. However, I wish to calculate a new tag every 6us, to reduce latency (since you have to buffer up a GCM "packet" before ...
0
votes
0answers
23 views

In AES is 0x11b is the specified field generator? [duplicate]

As I know all arithmetic operations in AES are done over $GF(2^8)$ so I want to know which field generator AES uses? is it 0x11B? and choosing another field generator would it give a different results?...
3
votes
1answer
86 views

AES-XTS vs AES-CTR for Write Once Storage

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
1
vote
1answer
99 views

Is There an Opensource Manual Calculation of AES-128 bit?

Is There an Opensource Manual Calculation of AES-128 bit as in Cronos I have to learn calculations manually.
11
votes
1answer
684 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
2
votes
0answers
57 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
2
votes
1answer
89 views

Is an IV useless for encrypting database IDs?

In my scenario I need to build a pseudo-anonimization service: a machine that given a plainID return a chiperID and vice-versa. <...
3
votes
2answers
129 views

How close is AES to random oracle model?

I'm wondering if there are any guarantees about AES's randomness in comparison to Random Oracle, but I couldn't find any papers nor publications about it. Let's say I have a blackbox B which for any ...
3
votes
0answers
417 views

What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

Studying AES on Wikipedia, I noticed a statement regarding some ongoing studies on the use of Kendall's Tau coefficient in cryptanalysis: According to the Snowden documents, the NSA is doing ...
2
votes
2answers
90 views

Safely erasing encrypted data

My secret message is encrypted in a byte buffer with AES-128 in CBC mode. The first 16 bytes are the IV and the message follows contiguously. If I want to securely delete this message is it enough ...
2
votes
1answer
47 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
1
vote
2answers
76 views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: ...
3
votes
2answers
142 views

Any point using CMAC with AES-256?

As we know, AES-256 is a block cipher with 256-bit key and 128-bit block size. The CMAC message authentication code outputs tag length equal to block cipher block size - thus 128 bits with AES. And ...
4
votes
1answer
215 views

A Lightweight Matrix Suggestion for MixColumns State of AES

We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
0
votes
2answers
92 views

Aes Ctr non-secure PRNG

I want to construct a seeder for a big state PRNG (xorshift1024 based) and have been thinking about using Aes Ctr using multiple 256 bit keys, where the counter is simply encrypted multiple times (...
1
vote
1answer
110 views

Given partial key exposure and encryption oracle, can we recover full AES key?

Suppose I have an encryption oracle for AES with some key $k$ (16 bytes) and that I know $n$ bytes of it. Is it possible to recover the rest ($16 - n$) in complexity less than $256^{16-n}$?
0
votes
1answer
45 views

Any side effects of switching from Rijndael to AES in a .net application?

Our company would like to update our .Net apps so that they can run on Windows machines that require FIPS compliance. Currently we are using the System.Security.Cryptography.Rijndael class. I changed ...
5
votes
1answer
522 views

Why doesn't the GCM spec use a more efficient multiplication algorithm?

NIST SP 800-38D § 6.3 Multiplication Operation on Blocks describes a multiplication algorithm that, in my testing, appears to be a good amount slower then algorithm 2.40 (arbitrary reduction ...
1
vote
1answer
49 views

Encrypting/Decrypting sensitive information for storage purpose

I want to store account numbers and routing numbers into SQL database, and i was looking for best way to encrypt/decrypt this sensitive information. After researching i found i can use symmetric (like ...
0
votes
2answers
159 views

How we can calculate AES Inverse SBox?

I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue. As in this question, How are the AES inverse S-...
18
votes
1answer
876 views

If a single bit was known through all states in AES, which would cause the most information to leak?

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule ...
2
votes
2answers
83 views

Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?

I have a file system with share resources over the network (like a shared FTP) Is it possible to use the client's ECC public key to encrypt the AES key, and then use the AES in CRT mode for the file ...
1
vote
2answers
78 views

Decrypting ciphertext that is missing a block

In the AES encryption, suppose that the key is known. The ciphertext is also known except for a block of the same size as the key. For example, the adversary knows $k, c_0, c_1, \dots, c_{n - 1}$; ...
-4
votes
2answers
249 views

AES_256_ENCRYPT_CTR(key, sha-1(plainText)+plainText) VS AES-GCM, which is more secure? [duplicate]

What if we encrypt sha-1 hash of the plain text, along with the plain text using AES-256 in CTR mode? How much future proof the above method would be in comparison to AES-GCM or any other method ...
27
votes
4answers
10k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
-3
votes
1answer
74 views

aes-ctr(key, ++iv, sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128))); is it secure? [closed]

Proposed Cipher suite: aes-ctr(key, ++iv, sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128))); Security targets achieved: Encryption of the plain text. Integrity of the ...
8
votes
1answer
166 views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
1
vote
1answer
72 views

Inversion in $GF(2^8)$ AES [duplicate]

I was wondering how you would calculate the S-box in AES. I found that you have to calculate the inverse of the polynomials in $GF(2^8)$. I found out that to calculate the inverse, you have to use the ...
1
vote
1answer
124 views

Can AES be broken by factorization (using Quantum Period Finding)?

I am trying to understand the paper "Breaking Symmetric Cryptosystems using Quantum Period Finding", and I reckoned the paper is roughly implying to break secret-key cryptographic system by finding ...
5
votes
1answer
111 views

Combining classical attacks and quantum cryptanalysis

I'm regularly reading that AES-256 is secure against quantum computers because Grover's algorithm will only halve the key strength (i.e. "only" require $\sqrt{2^l} = 2^{l/2}$ operations instead of the ...
1
vote
1answer
77 views

Disadvantage of the using a counter within plain text for encrypting with AES256 and authentication?

What if we use a counter within the plain text and then encrypt the plain text with aes 256 to encrypt & authenticate? For example: encryptAES(32bit_counter+plain_text_of_96bit); or encryptAES(...
1
vote
1answer
49 views

AES decryption of MixColumn

In the encryption of MixColumn you use the constants 01, 02 and 03. I don't understand why the inverse of 01 becomes both 0D and 09. I also don't understand how you get 01, 02 and 03 in the first ...
0
votes
1answer
62 views

How to apply IV and tag to protect messages encrypted using AES-GCM?

I'm applying the Arduino Crypto Library for the code fragments. In the above library, example of encryption and decryption using GCM given as follows: For encryption: ...
0
votes
1answer
73 views

Is the hash function $h(x\|y) = AES_x( y)$ collision resistant?

If $x$ and $y$ are both 128-bit strings would the function $h(x||y) = AES_x(y)$, where $x\|y$ means concatenation, be considered collision resistant ? Is there an easy way to find $(x_1, y_1)$ and $(...