# Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

2,633 questions
Filter by
Sorted by
Tagged with
1 vote
1 answer
12 views

### Putty PPK Encryption Questions (or AES-CBC)

I am learning about aes-cbc and to simplify things we need two parameters for encryption and randomness (key and IV). IV is random at runtime and will be used to randomize the first cipherblock which ...
• 111
1 vote
0 answers
14 views

### How Helpful is NXP's LRP Encryption Protocol vs AES for short keys?

NXP has a custom (I think) encryption protocol known as "Leakage-Resistant Primitive", or LRP, built on top of AES. I think the goal of this is to basically "expand" the length of ...
• 111
-1 votes
0 answers
25 views

### Padding oracle attack with known padding length

I have a question regarding the padding oracle attack. When I search the Internet the attack it seems that everyone has the same way of performing it. We learned another way in class and I try to ...
0 votes
1 answer
93 views
+100

### Row level database encryption scheme

I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online. My primary concerns are: ...
2 votes
2 answers
127 views

### Key Exhaustion Risks in Symmetric and Asymmetric Cryptography

For the symetric keys it is recommend that the same key should not be used to encrypt large number(2^32) of cipher blocks to avoid the key-exhaustion risk. Curious to know whether the asymmetric key ...
• 123
1 vote
0 answers
83 views
+150

### Security of $E(c,k) = AES(c,(k \oplus c)\cdot (2^{n} - 1 - c))$ used multiple times with low bit keys $k$. Avoids MitmA?

More precisely the Encryption function will be $E(c_i,k_i,i)$ with a 128-bit cipher/number $c_i$, a 16-bit encryption key $k_i$ and a 8-bit index $i$ as input using a Xor key obfuscation $k'$ with ...
• 433
1 vote
1 answer
44 views

### Can two different AES keys have the KCV by chance?

I am trying to check KCVs of a few keys. I am generating the KCV for the keys using the method mentioned here https://crypto.stackexchange.com/a/11873/115990 Question: Can KCVs of two different AES ...
• 113
-3 votes
0 answers
42 views

### school's exam, Is anyone know the two answer? [closed]

Here is a school's exam, Is anyone know the two answers ?. Thanks a lot !
0 votes
2 answers
57 views

### How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
0 votes
0 answers
16 views

### Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models

In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered. Typically, security proofs for cryptographic modes ...
1 vote
0 answers
68 views

### When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?

If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
• 197
2 votes
1 answer
81 views

### Using AES-CBC with a random number plus a counter for the IV

I understand that AES-CBC uses the following scheme for encrypting data (diagram from Wikipedia): And, I understand that we don't want initialization vectors to be predictable or constant, and also ...
• 123
0 votes
1 answer
57 views

### Can I prove AES-GCM nonce reuse just from the bytes?

I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
5 votes
1 answer
179 views

### New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
• 2,126
1 vote
1 answer
82 views

### AES-128 ECB Standard Confusion

Forgive my ignorance, but I've run into some confusion in an AES implementation I'm testing. To the best of my understanding, ECB provides no diffusion, the same plaintext with the same key will yield ...
4 votes
2 answers
629 views

### Utilizing block cipher (AES) while saving bandwith

I'm helping a company to redesign their cryptographic protocol for communication within a network of embedded devices. So far I have discovered several insecure practices, such as using very short (6 ...
1 vote
2 answers
69 views

### App for Secure delivery of the gray images using AES, DH, DSA - Help in implemeting the system structure

I have this uni project that I have to implement in code: "App for Secure delivery of the gray images, encryption-decryption with AES in OFB mode + secret key delivery using Merkle–Hellman ...
3 votes
1 answer
715 views

### Is AES a group?

The question I'm wondering is whether the AES cipher is a closed cipher (which is equivalent to AES being a group). And this question interests me due to the lack of understanding of whether it is ...
• 53
1 vote
0 answers
24 views

### Using longer key with PKCS#5 derive_key() function for AES256? [closed]

I have code where someone made the key 64 bytes (32*2) and passes to the derive_key() function. It then uses the key created for ...
• 133
0 votes
0 answers
33 views

### Is it possible for a given plaintext and ciphertext to have two different keys? [duplicate]

This has probably been asked before but for a given ciphertext and plaintext pair, is it possible to have two different keys producing said pair? Or there are no collisions in AES, unlike hashing ...
0 votes
1 answer
95 views

### Do I need to use unique IVs if all encrypted data is unique?

I am designing a service where each user has both a unique 256-bit private and public ID. These IDs should be derivable from one another, but only within the backend of my service (as to not expose ...
• 103
0 votes
1 answer
238 views

### Encrypting the nonce in AES-CCM

I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
0 votes
1 answer
109 views

### What exactly is RSA_WITH_AES256_CBC_SHA256?

Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES. I have a project where my service is receiving an ...
1 vote
0 answers
52 views

### Whitebox Cryptography Advances

I have an issue about AES whitebox protection as it is possible to decrypt data and get the whitebox encryption and decryption logic even without the ability to extract the original key. In my ...
• 11
0 votes
0 answers
136 views

### Known message attack on ENC-MAC with AES encryption

The assignment I have is as follows: Let $l=2^{128}$ and let $x$ be a random integer satisfying $0\le x \le l$ Let $\oplus$ be the XOR operator and $E_k$ an AES encryption with $key=k$ Let the ...
5 votes
1 answer
220 views

### What best to put in unused nonce bytes when using AES-GCM-SIV

I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
• 151
1 vote
0 answers
74 views

### Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?

For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical. So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x ...
0 votes
0 answers
53 views

### Does diffusion also include the reducibility inability of the $n$-times appliance of an encryption scheme? Or has this another name? Any proof for it?

With optimal diffusion the change of a single input bit should change every single output bit equally likely with a chance of 50% each (in mean). But this does not necessarily mean it makes it ...
• 21
0 votes
0 answers
67 views

### Exposing the vulnerability of CTR mode of operation

In the CTR mode of operation, the plaintext block is treated as a stream cipher, where each byte of the plaintext gets XOR-ed with each byte of the key (which is generated using a nonce and a counter) ...
0 votes
0 answers
61 views

### What should be passed as the authentication tag when creating a SealedBox? And can it be made public?

When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag: https://developer.apple.com/documentation/cryptokit/aes/gcm/...
1 vote
1 answer
121 views

### Find two hard to reverse functions f and h such that f ∘ h ∘ g = h (f and h injective, no constraints on g)

I am looking from 3 functions $f,g,h$ from $\mathbb N \to \mathbb N$ (they can be bijections, they need to be injective at least), such that: $$f \circ h \circ g = h$$ and $f$ is hard to reverse ...
-1 votes
1 answer
79 views

### Given and encrypted message, is it theoretically possible to decrypt a message without the key or guessing it? If so, what methods could be used?

Decrypting an AES-Encrypted Message Without the Key: A Cryptographic Challenge Summary: I am investigating the possibility of decrypting an AES-encrypted message when the encryption key is unknown ...
• 1
0 votes
0 answers
38 views

### High throughput authentication on ARMv8

I am working on a project where I need to authenticate data in parallel with computations on that data. The idea is to stream data from memory onto the chip only once; while the data is on-chip, we do ...
• 1
0 votes
2 answers
105 views

### AES CTR mode is insecure if key is chosen from a tiny keyspace

Given AES-128 with a 128 bit key, but the key is chosen such that its only last 16/32/48 bit are random rest are 0, how can i exploit this to know the key being used, given i have access to oracle ...
• 21
4 votes
1 answer
349 views

### Why is s=6n in AES Key Wrap?

In AES Key Wrap, we apply 6n AES encryptions for an input of n 64-bit blocks. Informally speaking, we wrap the key 6 times. What is the motivation behind 6? Why not 4 or 10? Is there something like a ...
1 vote
1 answer
107 views

### Pitfalls of manual AES encryption for data transfer

Context I've used OpenSSL to encrypt some socket communications. I am however using some functionality from the windows API that prevents me from using OpenSSL's opaque builtin sockets, so I am ...
• 151
0 votes
0 answers
64 views

### AES encryption step: calculate the byte substitution process

I am a self learner and tried to learn AES, so I have a book written in my native language. It has some practical examples about finite fields and AES. It has a question that asks me to calculate the ...
0 votes
0 answers
63 views

### In AES, while Converting Plain text to HEX in this image, how is X 23 and not 17 while all others are in Hex state

In AES, while Converting Plain text to HEX in this image, how is X 23 and not 17 while all others are in Hex state.
3 votes
2 answers
657 views

### LUKS AES XTS key size and performance - is it only a CPU operation or does it involve disk read / write time?

AES256 is said to be around 20% slower than AES128 (at least it was on my own benchmark). Is it slower only because of increased computation cost or does it also involve disk access? Let's say I ...
1 vote
1 answer
83 views

### Keystream reuse in AES-256 in AE-2 encrypted ZIPs

Is keystream reuse a meaningful concern in AES-256 encrypted ZIP files that adhere to the AE-2 spec? From “Attacking and Repairing the WinZip Encryption Scheme” by Tadayoshi Kohno when using 256-bit ...
3 votes
2 answers
380 views

### What input parameters can be made public in the AES-CTR mode?

Preface: I am beginner of cryptography and not native English speaker. So I may make terrible mistake (about grammar and cryptography). I understand that the parameters used for AES-CTR are "key&...
• 31
2 votes
1 answer
144 views

### WinZip AE-2 for small files and AE-1 for larger - how small/how large for each?

I'm adding password protection/encryption support to a Python package that makes ZIP files (https://github.com/uktrade/stream-zip). I'm opting to not add ZipCrypto support, but instead add WinZip-...
3 votes
1 answer
148 views

### High volume encryption with AES-GCM: AWS KMS vs CloudHSM

In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
• 31
0 votes
1 answer
66 views

### Encryption Algorithm that has no right key

is there an encryption algorithm where no key is wrong, but only one key is right? essentially, if I encrypt some data with key X, any random "key" can "decrypt" the text, but ...
• 101
2 votes
1 answer
132 views

### Hashed Password Kerberos PKDF2 AES - ActiveDirectory

I know that in Active Directory environments passwords are stored in the form of hashes depending on encryption types used in the environment. I understand also that when using AES as a symmetric ...
0 votes
0 answers
39 views

### Using a hash instead of AES-CTR before XORing a plaintext [duplicate]

In AES-CTR, a key, a nonce and a counter are all encrypted to produce a value that is then XORed with a plaintext to produce the ciphertext. Let's say we were to make a hash out of the key, the nonce ...
• 101
2 votes
2 answers
111 views

### Is it a bad idea to use the same password and container size for multiple veracrypt container?

I'm new here and have a basic question about encryption. I plan to securely store sensitive data on a company computer. Being one of hundreds little branches of a bigger company, it is not possible to ...
• 21
0 votes
0 answers
69 views

### AES SBOX Masking in Python

I am trying to create an AES Sbox masking based on this paper. In the paper, they tried to mask the sbox described in this other paper. The inversion is been done in GF(4). I know that it is mostly ...
• 1
1 vote
0 answers
59 views

### Identified Performance Discrepancy in my AES addRoundKey: Slower than Expected

Problem I'm working on an AES implementation in C++, and I have been testing the performance of my code, and its functions. I've noticed a significant performance slowdown in my 'addRoundKey' function....
• 101
2 votes
1 answer
276 views

### Choosing (key,plain) to produce zero state in middle rounds of AES encrypt

I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
• 420