Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
16 votes
3 answers
23k views

Has AES-128 been fully broken?

Has AES-128 been broken over the full 10 rounds? If so, by what means? By a commercial entity? By a supercomputer? If not, why is AES-256 used to replace AES-128 so frequently?
Offir's user avatar
  • 283
7 votes
1 answer
3k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
Omer Levi Hevroni's user avatar
14 votes
1 answer
7k views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
ams's user avatar
  • 631
60 votes
6 answers
56k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
Jeff Ferland's user avatar
18 votes
2 answers
28k views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext pair?

I have a file, which was encrypted with AES-128 in ECB mode. I know the format of the original file and know that all files in this format have the same headers. So, I have an encrypted block and the ...
Denis Bezrukov's user avatar
90 votes
4 answers
105k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
samoz's user avatar
  • 3,236
25 votes
2 answers
22k views

How bad it is using the same IV twice with AES/GCM?

I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
Matteo Monti's user avatar
  • 1,407
14 votes
4 answers
9k views

Disadvantages of AES-CTR?

On paper, it sounds *very* good to me: secure fast (in my tests it's somewhat slower than ECB (but without most of the weaknesses, more on that below) but faster than every other alternative I tested,...
hanshenrik's user avatar
24 votes
4 answers
38k views

Is using the same IV in AES similar to not using an IV in the first place?

So if I understand how an IV works with AES, I'm supposed to generate a different IV for every message because using only a key, I will get the same encryption if the message was encrypted twice (...
Ali_Nass's user avatar
  • 343
14 votes
3 answers
13k views

Multiplicative inverse in $\operatorname{GF}(2^8)$?

I know how to do multiplication over ${\rm GF}(2^8)$: ...
Melvin's user avatar
  • 331
99 votes
1 answer
168k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
Maarten Bodewes's user avatar
  • 92.6k
37 votes
2 answers
14k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
Ashwin's user avatar
  • 473
9 votes
1 answer
3k views

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
gorte's user avatar
  • 167
40 votes
2 answers
38k views

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take $2^{64}$ operations, not $2^{128}$). That explains why we are using 256-...
AES256's user avatar
  • 417
31 votes
2 answers
6k views

Blum Blum Shub vs. AES-CTR or other CSPRNGs

Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
Polynomial's user avatar
  • 3,527
22 votes
1 answer
6k views

Related-key attacks on AES

According to Wikipedia: Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively. What are the requirements for these attacks (i.e how many ...
Chris Smith's user avatar
  • 1,192
20 votes
4 answers
14k views

Is there a standard for OpenSSL-interoperable AES encryption?

Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64). I hear it's ...
David Cary's user avatar
  • 5,664
18 votes
1 answer
4k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
knaccc's user avatar
  • 4,732
11 votes
1 answer
6k views

AES timing attacks

I'm just interested in cryptography, so please don't expect me to be an expert. ;) I recently read about AES cache timing attacks and found it very interesting. I read the article Cache-timing attacks ...
cooky451's user avatar
  • 257
9 votes
3 answers
17k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
Richard Jones's user avatar
4 votes
2 answers
2k views

Is direct RSA encryption of AES keys secure?

I am wondering: If we take this scheme/procedure and each of it seems very secure (to me at least), is it truly secure or is there a vulnerability hidden in the process? This is the scheme: Bob has ...
alberto123's user avatar
43 votes
2 answers
13k views

Is AES-128 quantum safe?

I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones: Can quantum attackers break ...
Jimakos's user avatar
  • 755
34 votes
2 answers
17k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
Fixee's user avatar
  • 4,158
24 votes
2 answers
6k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
J_M's user avatar
  • 341
11 votes
4 answers
38k views

Can I find the encryption key if I know the plain text and the encrypted text (DES and AES)?

If I have the plain text and its output after encryption with a key K1, is it algorithmically feasible to find K1? I am specifically interested in the cases of DES and AES encryption algorithms.
Joezer's user avatar
  • 213
6 votes
1 answer
5k views

Encrypt a file with AES using a secret key derived with Argon2

I would like to encrypt some sensitive files on my computer and smartphone so that they remain unreadable even if the computer is stolen. So far as I'm concerned, AES is the best encryption algorithm,...
K. Gabor's user avatar
44 votes
2 answers
37k views

AES-GCM recommended IV size: Why 12 bytes?

When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from. Let's assume a ...
Hendrikvh's user avatar
  • 543
7 votes
2 answers
4k views

Combining multiple symmetric encryption algorithms - implications?

I was just wondering if I add more security by combining two or more symmetric encryption algorithms on a plain text. For example: ...
Chris's user avatar
  • 325
27 votes
3 answers
10k views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
DeepSpace101's user avatar
  • 1,697
22 votes
3 answers
23k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
KeithS's user avatar
  • 540
22 votes
4 answers
82k views

How long would it take to brute force an AES-128 key?

How long would it take to crack a AES-128 key using the most advanced technology currently available? The hardware can be anything, be it a high-performance CPU, GPU or even FPGA?
Joy's user avatar
  • 321
17 votes
1 answer
48k views

How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over $GF(2^8)$, but I'm confused by the description of the affine transformation. ...
ConditionRacer's user avatar
13 votes
3 answers
13k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the keysize ...
goldroger's user avatar
  • 1,727
12 votes
2 answers
9k views

How were the number of rounds for different key sizes of AES selected?

The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?
user avatar
3 votes
1 answer
1k views

Is it dangerous to encrypt lots of small files with the same key?

I want to encrypt 1000s of old files on old hard drives before uploading them to the cloud. I'm planning to use AES-GCM with only one or a few keys. (I'm using Apple's CryptoKit library which provides ...
Rob N's user avatar
  • 133
47 votes
2 answers
77k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
mary's user avatar
  • 1,031
26 votes
2 answers
78k views

How to solve MixColumns

I can't really understand MixColumns in the Advanced Encryption Standard, can anyone help me how to do this? I found some topics on the internet about MixColumns, but I still have a lot of questions ...
goldroger's user avatar
  • 1,727
10 votes
1 answer
594 views

Is there any reason not to use Single-Key EM with AES and a constant key?

I've read recently the paper "Minimalism in Cryptography: The Even-Mansour Scheme Revisited" by Dunkelman, Keller and Shamir where it is claimed that the following construction (Single-Key EM) is ...
SEJPM's user avatar
  • 46k
91 votes
5 answers
41k views

Is AES-256 weaker than 192 and 128 bit versions?

From a paper via Schneier on Security's Another AES Attack (emphasis mine): In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
quantumSoup's user avatar
  • 1,021
39 votes
3 answers
11k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
Richard R. Matthews's user avatar
14 votes
3 answers
2k views

Can one claim that AES is a perfect cipher?

I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ...
sol's user avatar
  • 141
11 votes
2 answers
6k views

Consequences of AES without any one of its operations

Suppose AES-$128$. There are $4$ operations in AES's encryption, they are SubByte, Shift Row, MixColumns and AddRoundKey. Question: If I remove one of the following opearations, what will happen to ...
Idonknow's user avatar
  • 491
10 votes
3 answers
14k views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
Heathkit7's user avatar
  • 101
8 votes
1 answer
8k views

Advantage of AES(Rijndael) over Twofish and Serpent

I'm trying to figure out a suitable encryption technique and after reading a bit, I figured the current AES 128-bit encryption is suitable for what I'm trying to do. However, this is more due to the ...
GamingX's user avatar
  • 647
7 votes
1 answer
965 views

How to securely encrypt/decrypt data with a maximum chunk size?

I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
user239146146's user avatar
6 votes
1 answer
3k views

How to find the AES branch number?

By definition, branch number Definition: The branch number of a linear transformation $F$ is $$min_{a\neq0}(W(a) + W(F(a)))$$ Source here (7.3.1) For AES MixColumns $a \in GF(2^8)^4$ since ...
Sasha's user avatar
  • 63
2 votes
1 answer
375 views

Any theory about period length for AES applied to itself?

For example AES-128 starting with a 128-bit message $m_0$ and static 128 key $k$ $AES128(m_0,k)\rightarrow c_0$ $c_0\rightarrow m_1$ $AES128(m_1,k)\rightarrow c_1$ $c_1\rightarrow m_2$ ... continue ...
J. Doe's user avatar
  • 433
87 votes
5 answers
280k views

How secure is AES-256?

The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers. In theory it's not crackable since the combinations of keys are massive. Although ...
Gustav's user avatar
  • 1,065
31 votes
3 answers
86k views

Why we can't implement AES 512 key size?

Out of curiosity why we can't implement AES 512 key size? Please explain somehow i can understand! I'm not an expert.
hamedb71's user avatar
  • 511
23 votes
3 answers
6k views

Known methods for constant time (table-free) AES implementation using 'standard' operations?

There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
Jack Lloyd's user avatar
  • 1,694

1
2 3 4 5
10