Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
1 vote
0 answers
17 views

How Helpful is NXP's LRP Encryption Protocol vs AES for short keys?

NXP has a custom (I think) encryption protocol known as "Leakage-Resistant Primitive", or LRP, built on top of AES. I think the goal of this is to basically "expand" the length of ...
1 vote
1 answer
15 views

Putty PPK Encryption Questions (or AES-CBC)

I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
0 votes
1 answer
93 views
+100

Row level database encryption scheme

I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online. My primary concerns are: ...
0 votes
1 answer
892 views

AES Password Based Key Derivation Iterations

I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
-1 votes
0 answers
25 views

Padding oracle attack with known padding length

I have a question regarding the padding oracle attack. When I search the Internet the attack it seems that everyone has the same way of performing it. We learned another way in class and I try to ...
1 vote
1 answer
136 views

Does using multiple encryption algorithms with different keys on the same cipher text improve security?

I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
1 vote
0 answers
84 views
+150

Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c)) $ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
2 votes
2 answers
127 views

Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
1 vote
1 answer
44 views

Can two different AES keys have the KCV by chance?

I am trying to check KCVs of a few keys. I am generating the KCV for the keys using the method mentioned here https://crypto.stackexchange.com/a/11873/115990 Question: Can KCVs of two different AES ...
2 votes
3 answers
4k views

What is the advantage of CFB over OFB?

I was wondering if CFB can be better than OFB in any ways. I would like to know in what cases one would use CFB over OFB.
-3 votes
0 answers
42 views

school's exam, Is anyone know the two answer? [closed]

Here is a school's exam, Is anyone know the two answers ?. Thanks a lot !
0 votes
2 answers
57 views

How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
2 votes
1 answer
231 views

Which encryption technique should be adopted to keep the search functionalities?

I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
2 votes
2 answers
140 views

AES security: how many rounds we need to fall the differential probability below 2^(-128) in the case of that branch number is 3

In AES, the MixColumns operation involves a linear transformation from GF(2^8)^4 to GF(2^8)^4. The branching factor for this transformation in the original AES is 4, and it is considered secure ...
0 votes
0 answers
16 views

Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models

In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered. Typically, security proofs for cryptographic modes ...
1 vote
1 answer
6k views

Hash-Then-Encrypt or Encrypt-Then-Hash?

The question is about site-to-site transmission where the recipient needs to decrypt the incoming data. What method is more secure and make it harder to decrypt, Hash-Then-Encrypt or Encrypt-Then-Hash?...
1 vote
0 answers
68 views

When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?

If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
1 vote
1 answer
293 views

Multiple Encryption Using GCM For Multi-Key Security

Multiple Encryption For Multi-Key Security I have a hypothetical question about multiple encryption after reading Matthew Green’s blog on multiple encryption. For those who are familiar with GCM…I ...
5 votes
1 answer
179 views

New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
2 votes
1 answer
81 views

Using AES-CBC with a random number plus a counter for the IV

I understand that AES-CBC uses the following scheme for encrypting data (diagram from Wikipedia): And, I understand that we don't want initialization vectors to be predictable or constant, and also ...
0 votes
1 answer
57 views

Can I prove AES-GCM nonce reuse just from the bytes?

I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
24 votes
2 answers
6k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
1 vote
1 answer
229 views

Figure out chosen-plaintext-attack in Zerologon attack

Actually, I'm reading the description about Zerologon attack from the original whitepaper document. In there, Tom Tervoort mentions these sentences: So I tried to come up with some chosen-plaintext ...
1 vote
1 answer
82 views

AES-128 ECB Standard Confusion

Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing. To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
1 vote
1 answer
121 views

Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

I am looking from 3 functions $f,g,h$ from $\mathbb N \to \mathbb N$ (they can be bijections, they need to be injective at least), such that: $$f \circ h \circ g = h $$ and $f$ is hard to reverse ...
1 vote
2 answers
69 views

App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure

I have this uni project that I have to implement in code: "App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
4 votes
2 answers
629 views

Utilizing block cipher (AES) while saving bandwith

I'm helping a company to redesign their cryptographic protocol for communication within a network of embedded devices. So far I have discovered several insecure practices, such as using very short (6 ...
3 votes
1 answer
715 views

Is AES a group?

The question I'm wondering is whether the AES cipher is a closed cipher (which is equivalent to AES being a group). And this question interests me due to the lack of understanding of whether it is ...
1 vote
0 answers
24 views

Using longer key with PKCS#5 derive_key() function for AES256? [closed]

I have code where someone made the key 64 bytes (32*2) and passes to the derive_key() function. It then uses the key created for ...
21 votes
3 answers
2k views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
0 votes
0 answers
33 views

Is it possible for a given plaintext and ciphertext to have two different keys? [duplicate]

This has probably been asked before but for a given ciphertext and plaintext pair, is it possible to have two different keys producing said pair? Or there are no collisions in AES, unlike hashing ...
0 votes
1 answer
95 views

Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
0 votes
1 answer
238 views

Encrypting the nonce in AES-CCM

I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
0 votes
1 answer
109 views

What exactly is RSA_WITH_AES256_CBC_SHA256?

Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES. I have a project where my service is receiving an ...
3 votes
1 answer
148 views

High volume encryption with AES-GCM: AWS KMS vs CloudHSM

In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
0 votes
1 answer
75 views

MOSH - Decrypt session when the shared secret is known

Currently I'm working on an intercepting proxy server for mosh connections. I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
1 vote
0 answers
52 views

Whitebox Cryptography Advances

I have an issue about AES whitebox protection as it is possible to decrypt data and get the whitebox encryption and decryption logic even without the ability to extract the original key. In my ...
0 votes
0 answers
136 views

Known message attack on ENC-MAC with AES encryption

The assignment I have is as follows: Let $l=2^{128}$ and let $x$ be a random integer satisfying $0\le x \le l$ Let $\oplus $ be the XOR operator and $E_k$ an AES encryption with $key=k$ Let the ...
1 vote
1 answer
107 views

Pitfalls of manual AES encryption for data transfer

Context I've used OpenSSL to encrypt some socket communications. I am however using some functionality from the windows API that prevents me from using OpenSSL's opaque builtin sockets, so I am ...
5 votes
1 answer
220 views

What best to put in unused nonce bytes when using AES-GCM-SIV

I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
1 vote
2 answers
333 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
9 votes
1 answer
3k views

Poly1305-AES vs AES-GCM

What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons ...
1 vote
0 answers
74 views

Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?

For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical. So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x ...
-1 votes
1 answer
79 views

Given and encrypted message, is it theoretically possible to decrypt a message without the key or guessing it? If so, what methods could be used?

Decrypting an AES-Encrypted Message Without the Key: A Cryptographic Challenge Summary: I am investigating the possibility of decrypting an AES-encrypted message when the encryption key is unknown ...
0 votes
0 answers
53 views

Does diffusion also include the reducibility inability of the $n$-times appliance of an encryption scheme? Or has this another name? Any proof for it?

With optimal diffusion the change of a single input bit should change every single output bit equally likely with a chance of 50% each (in mean). But this does not necessarily mean it makes it ...
0 votes
0 answers
67 views

Exposing the vulnerability of CTR mode of operation

In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
20 votes
4 answers
14k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
0 votes
0 answers
61 views

What should be passed as the authentication tag when creating a SealedBox? And can it be made public?

When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag: https://developer.apple.com/documentation/cryptokit/aes/gcm/...
0 votes
0 answers
38 views

High throughput authentication on ARMv8

I am working on a project where I need to authenticate data in parallel with computations on that data. The idea is to stream data from memory onto the chip only once; while the data is on-chip, we do ...
0 votes
2 answers
105 views

AES CTR mode is insecure if key is chosen from a tiny keyspace

Given AES-128 with a 128 bit key, but the key is chosen such that its only last 16/32/48 bit are random rest are 0, how can i exploit this to know the key being used, given i have access to oracle ...

1
2 3 4 5
53