Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

282 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
7 votes
0 answers
382 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
Makif's user avatar
  • 820
6 votes
0 answers
135 views

About the complexity of a path finding attack for a path encrypted with a block cipher (like AES). How many AES calculations count as secure?

Out of $N = s^3$ total points we pick a starting point $p$ and an end point $q$ with $$p=(p_1, p_2)$$ $$q=(q_1,q_2)$$ $$p_1,q_1 \in [0,s)$$ $$p_2,q_2 \in [0,s^2)$$ We want to find a path in between ...
J. Doe's user avatar
  • 453
6 votes
0 answers
215 views

Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$ $\DeclareMathOperator{\E}{E}$ Suppose that you have access to an ...
SciresM's user avatar
  • 61
6 votes
0 answers
566 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kinds of keys: RSA public/private, AES, ...
David Szalai's user avatar
6 votes
2 answers
536 views

DES and AES cryptography

I have a question that I can't answer: A plain text has been encrypted 3 times in a DES method with 3 different keys 56 bit each, after it the text was encrypted for the forth time using a AES ...
Aon Goldfinger's user avatar
5 votes
0 answers
151 views

Resistance to integral attacks by North Korean block cipher Jipsam1

The cipher is a modification to AES and is described on this website: The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely $$ \begin{...
forest's user avatar
  • 15.3k
5 votes
0 answers
560 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
fgrieu's user avatar
  • 141k
4 votes
0 answers
149 views

Why Block Ciphers

I​ fail to understand what block ciphers can do that stream ciphers cannot. Also aren't they construct able from one another. prg(stream cipher) -> prf -> prp(block cipher) Any practical example ...
xzijoq's user avatar
  • 41
4 votes
0 answers
217 views

How do byte-sliced AES implementations work?

While I understand the principle of bit-slicing, several papers mention byte-sliced AES implementations (see e.g. Homomorphic Evaluation of the AES Circuit and Fast Implementations of AES on Various ...
Raoul722's user avatar
  • 2,836
4 votes
0 answers
384 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
Robert Schaffar-Taurok's user avatar
4 votes
0 answers
164 views

AES-256 9 round related key attack - getting possible state differences

I'm trying to implement related key attack on 9 round AES256, described here: Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to ...
Tlsfd's user avatar
  • 41
4 votes
0 answers
800 views

XTS-AES-128 and Grover's algorithm

AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits. XTS-AES-128 as described in IEEE 1619-2007 doubles key ...
arsv's user avatar
  • 141
4 votes
0 answers
241 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
Demi's user avatar
  • 4,793
4 votes
2 answers
171 views

What would be the requirements for a new-age cipher standard?

While nowhere near being broken, AES has known attacks like reading from the substitution table, memory-based attacks, etc. If we keep getting better at breaking ciphers and we eventually get close to ...
Franartur Čech's user avatar
3 votes
1 answer
148 views

High volume encryption with AES-GCM: AWS KMS vs CloudHSM

In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
Florian's user avatar
  • 31
3 votes
0 answers
136 views

AES subkey calculation not working for subkeys beyond 0 and 1

How should I generate the remaining keys when performing subkey generation in AES encryption? I generated keys 0 and 1 first, but the other keys I generated later were wrongly generated, so what steps ...
Mohamed Mohamed Mourad Abdel W's user avatar
3 votes
0 answers
140 views

AES first and last round key whitening

I've found this question from 2014 on Key Whitening: How exactly does key whitening manage to increase security? where is said that AES applies key whitening internally by adding a sub-key prior to ...
LianoQ's user avatar
  • 71
3 votes
0 answers
316 views

Encrypt/Cipher and Decrypt/Decipher a string with a secret

In developing an app I have a simple use case in where I want to encrypt/cipher a string (it could also be a couple of bytes because it's essentially just an IP-Address). On the output I think it ...
fonzane's user avatar
  • 131
3 votes
0 answers
263 views

Is there any real attack deployed on the CTR mode over history?

The CTR mode, with its CPA security, is one of the malleable block cipher mode of operations. An attacker can simply modify the bits of the ciphertext stream in their advance. This is due to the lack ...
kelalaka's user avatar
  • 48.5k
3 votes
0 answers
98 views

How is the time intereval calculated for symmetric key re-negoatition in UK Security Standard – Use of Cryptography?

According to point 10.6.4 (Encryption in Transit) in Security Standard –Use of Cryptography, one of the criteria for key renegotiation is timeout , Encrypted sessions MUST re-negotiate new symmetric ...
hardyrama's user avatar
  • 2,126
3 votes
0 answers
1k views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
Brian M. Hunt's user avatar
3 votes
0 answers
6k views

Support for hardware-accelerated crypto AES on ARMv8 processors running in 32-bit mode?

As I understand it, all ARM processors based on the 32/64-bit ARMv8-A architecture (and more recent iterations) support hardware-accelerated AES instructions. Under Linux, the feature flags in ...
Dan Lenski's user avatar
3 votes
0 answers
210 views

Optimizing the AES key schedule when round keys cannot be cached

I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
forest's user avatar
  • 15.3k
3 votes
0 answers
205 views

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes). For ...
Victor Iorinescu's user avatar
3 votes
0 answers
333 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
maletor's user avatar
  • 131
3 votes
0 answers
70 views

Does this approach on MEDP take into account the multiple differential trails?

I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES: I cannot fully understand what he is doing but it seems like it iterating over all ...
Anton Paragas's user avatar
3 votes
0 answers
193 views

Implement Twofish cipher with 16-bit blocksize?

I've seen implementation of Rijndael cipher with 16-bit blocksize. And I have also tried to implement 16-bit Rijndael cipher by myself with only a little sneak peeking at the example of the ...
BufferOverflow's user avatar
3 votes
0 answers
1k views

How can I find or reverse engineer the whitening in an AES algorithm?

I am working with this black box cryptography scheme. I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes. I have two ...
John's user avatar
  • 31
3 votes
0 answers
398 views

Fortuna PRNG: What is the effect of the block cipher key size?

The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting ...
quantifier's user avatar
3 votes
0 answers
344 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo-code the actions taking place are like this: Alice's actions for sending a secret ...
Alfe's user avatar
  • 219
3 votes
0 answers
2k views

Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
bkjvbx's user avatar
  • 1,554
3 votes
0 answers
692 views

Is there any analysis of freebsd's "geli" encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
Jeff Epler's user avatar
2 votes
1 answer
135 views

Hashed Password Kerberos PKDF2 AES - ActiveDirectory

I know that in Active Directory environments passwords are stored in the form of hashes depending on encryption types used in the environment. I understand also that when using AES as a symmetric ...
Matías Huartamendía's user avatar
2 votes
2 answers
105 views

Using the MAC to verify if Cipher Only attack has succeeded

I am working on an experiment to compare the efficiency of brute-force attacking block ciphers like AES and DES with reduced key sizes for different programming languages and library implementations. ...
Matt's user avatar
  • 21
2 votes
0 answers
59 views

Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?

I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
cmdruid's user avatar
  • 21
2 votes
0 answers
94 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
2 votes
0 answers
107 views

AES key encryption on one time pad

I need to use the following scenario: There are 2 keys: AES-key and OTP-key (one-time pad). I encrypt the AES-key (as if it were plaintext) with an OTP key. Then I send the encrypted AES-key to ...
Ss1996's user avatar
  • 53
2 votes
0 answers
71 views

Secure option for (hybrid) encryption of a secret key using JWE

I want to encrypt a private key $sk$ (it's actually an RSA private key in PKCS#8 format) with another person's (and/or my) public key $pk_A$ for secure storage. With JWE, it is possible to use hybrid ...
bertrandrussellsghost's user avatar
2 votes
0 answers
97 views

Can other modes be applied in OpenPGP (not using CFB mode)?

According to https://www.rfc-editor.org/rfc/rfc4880.html#section-13.9 -> OpenPGP only mentioned about CFB mode. According to https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-...
Andy's user avatar
  • 71
2 votes
0 answers
91 views

How much information is required to specify a new variant of AES beyond the key length and the number of rounds?

Three different versions of the Advanced Encryption Standard (AES) have been standardized, which use keys of bit length 128, 192, and 256 respectively. They also use different numbers of rounds: 10, ...
tparker's user avatar
  • 165
2 votes
0 answers
268 views

Reconstructing the AES-192 key out of the last roundkey

Lets assume we know the last-round key of AES. For AES-128, the whole key can be reconstructed using the last-round key since every WORD in the key schedule is based on the previous 128-bit entry. For ...
hooujki's user avatar
  • 41
2 votes
1 answer
232 views

Which encryption technique should be adopted to keep the search functionalities?

I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
Marc Alves's user avatar
2 votes
0 answers
59 views

How is the 'Algebraic Degree' calculated in the paper about analysing the white-box AES(Chow et al. 2002) by exploiting internal collisions?

This paper proposed a new attack on the initial white-box AES implementation of Chow et al. In order to determine the good solution, we use the particular structure of the function $S_{0}$. $S^{-1} \...
leet's user avatar
  • 21
2 votes
0 answers
161 views

AES encryption for repetitive small data packets

I'm trying to implement simple AES encryption for small data packets (8bytes, fixed length) being sent from nodes with very little computational resources. Ideally the encrypted data would be a single ...
whatsinaname's user avatar
2 votes
0 answers
42 views

Looking for a way to enlarge a message so that any modification to the "enlarged" message makes recovering the original message impossible

Let's say we have a message m of small size. I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...
MATHIEU SERAPHIM's user avatar
2 votes
0 answers
120 views

Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...
MultiUserDude's user avatar
2 votes
0 answers
95 views

Why is double encryption used to generate EphIDs in DP3T?

The most famous proposed COVID-19 application is DP3T. In this app a user constantly broadcasts EphIDs generated from a secret key as follows: $$EphID 1 || ... || EphID n = PRG( PRF(SK_t , “broadcast ...
Ruben_G's user avatar
  • 21
2 votes
0 answers
138 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
user3368561's user avatar
2 votes
0 answers
859 views

AES-XTS Integrity protection

AES-XTS does not guarantee data integrity, like AES-GCM for instance. So, in order to support data integrity it is necessary to add some MAC functionality to it. However, adding an independent MAC, ...
Evgeni Vaknin's user avatar

1
2 3 4 5 6