Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

128 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
1answer
533 views

Tiny Firmware Authentication

I am developing a product based on the NXP LPC11C24 microcontroller. It will communicate with PC software to perform its function. I am attempting to build a secure firmware update functionality. The ...
5
votes
0answers
251 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
5
votes
0answers
462 views

File Encryption (EFS method)

I'm implementing (for learning purposes) a file encryptor, which uses the following method (from http://en.wikipedia.org/wiki/Encrypting_File_System). I have 3 kind of keys: RSA public/private, AES ...
5
votes
2answers
430 views

DES and AES cryptography

I have a question that I can't answer: A plain text has been encrypted 3 times in a DES method with 3 different keys 56 bit each, after it the text was encrypted for the forth time using a AES ...
4
votes
0answers
193 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
4
votes
0answers
207 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
4
votes
0answers
215 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
3
votes
0answers
58 views

Any white-box cryptography for asymmetric-key? What is the latest status of white-box cryptography?

I am learning white-box cryptography. So far, I find the following historical research or implementations, for examples: Published white-box AES algorithms E.g., Chow's WB AES and WB DES (2002), WB ...
3
votes
1answer
237 views

AES-XTS vs AES-CTR for Write Once Storage

I have a disk on which each sector can only be written once (like a journal, only appending is possible). Unused sectors are reported as being filled with zeroes, while used sectors should not be ...
3
votes
0answers
127 views

Optimizing the AES key schedule when round keys cannot be cached

I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
3
votes
0answers
175 views

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes). For ...
3
votes
0answers
180 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
3
votes
0answers
134 views

AES-256 9 round related key attack - getting possible state differences

I'm trying to implement related key attack on 9 round AES256, described here: Biryukov, Dunkelman, Keller, Khovratovich, Shamir, but I am stuck at the very beginning with Observation A, used to ...
3
votes
0answers
469 views

What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

Studying AES on Wikipedia, I noticed a statement regarding some ongoing studies on the use of Kendall's Tau coefficient in cryptanalysis: According to the Snowden documents, the NSA is doing ...
3
votes
0answers
62 views

Does this approach on MEDP take into account the multiple differential trails?

I was reading this (chapter 3.1) paper, and the author proposed this method to calculate the MEDP on 2-round AES: I cannot fully understand what he is doing but it seems like it iterating over all ...
3
votes
0answers
132 views

Implement Twofish cipher with 16-bit blocksize?

I've seen implementation of Rijndael cipher with 16-bit blocksize. And I have also tried to implement 16-bit Rijndael cipher by myself with only a little sneak peeking at the example of the ...
3
votes
0answers
646 views

How can I find or reverse engineer the whitening in an AES algorithm?

I am working with this black box cryptography scheme. I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes. I have two ...
3
votes
0answers
55 views

AES or cryptobox() for authenticated encryption

I need to encrypt some packets on a constrained hardware. I was enthusiast about the NaCl suit, since Chacha/Salsa20 is a nice and fast symmetric cipher algorithm when no AES-NI instructions is ...
3
votes
0answers
170 views

Fortuna PRNG: What is the effect of the block cipher key size?

The Fortuna PRNG uses AES-256 for generating output blocks by encrypting a counter value $C$ in CTR mode using a 256-bit key $K$. For the analysis, it seems the block size of 128 is the limiting ...
3
votes
0answers
940 views

Are there key collisions in AES-192, AES-256?

Suppose we have a single, fixed plaintext block $p$ of 128 bits. Call the set of all possible 128 bit blocks $B$. We could define fixed plaintext AES-128 as a function $f(k) \to B$ that takes a 128 ...
3
votes
0answers
429 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
3
votes
0answers
622 views

Is there any analysis of freebsd's “geli” encrypted geometry provider?

I've done a few obvious searches on google and google scholar and not turned up any security analysis of FreeBSD's geli. Is there some out there, or has it gone unanalyzed since its introduction ...
2
votes
0answers
81 views

Is AES resilient to chosen plaintext with access to related keys (key expansion primitives)?

I'm interested in knowing whether a cryptosystem is broken given access to a few primitives. $\DeclareMathOperator{\KEYEXP}{KEY\_EXP}$ $\DeclareMathOperator{\E}{E}$ Suppose that you have access to an ...
2
votes
0answers
80 views

AES-128 8th round bit fault propagation

It's well known that by injecting a byte fault during the 8th round of AES 128 just before the mix column the key can be recovered with $2^{32}$-key space. A brute force attack is then possible but ...
2
votes
0answers
86 views

How can the Rijndael SBox be written as a linearized polynomial?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(...
2
votes
0answers
249 views

WebCrypto AES-GCM vs AES-KW for key wrapping

The Web Crypto API available in most browsers supports both AES-GCM and AES-KW for key wrapping. There are examples for AES-KW and AES-GCM performing key wrapping, and a popular live table indicates ...
2
votes
0answers
48 views

How do we perform second order differential power analysis attack?

I have read papers which describe that the power traces(acquired from a side channel resistant implementation like masking) need to be centered and squared, then a correlation needs to be performed ...
2
votes
0answers
308 views

Seekable cipher, is AES CTR a good solution?

I'd like to create a simple file-cipher, which provides seekable encryption (so I can decrypt any part of the encrypted message, without the need of decrypt from the start). Here's my current idea: I ...
2
votes
0answers
339 views

XTS-AES-128 and Grover's algorithm

AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits. XTS-AES-128 as described in IEEE 1619-2007 doubles key ...
2
votes
0answers
206 views

AES-CTR and AES-CMAC using the same temporary key

Is it a severe security issue using a short-lived dynamic key for both AES-CTR and AES-CMAC? CMAC is generated on the cleartext and 32 bit of it are attached to the message (MAC-and-Encrypt) The key ...
2
votes
0answers
174 views

If we use another irreducible polynomial for AES how can we show it is still resistant to DCA and LCA?

AES has been rigorously tested against all known attacks. However, I believe there are 30 suitable irreducible polynomials that could be used for AES. If we were to change the current irreducible poly ...
2
votes
0answers
136 views

Is AES CBC + truncated SHA-256 MAC a good design for embedded sensor networks?

I'll start off by saying I'm a noob with respect to software security but I've been reading about security models for a while. Also, I'm afraid some people would just say "go and hire a security ...
2
votes
0answers
31 views

Explanation of the generalisation of multiset properties to a concatenation of a block

I am trying to learn about SASAS cryptanalysis. I am reading the paper related to this where the authors use multisets are used within the cryptanalysis of this cipher. I did not understand the part ...
2
votes
0answers
191 views

Conforming to best practices in password file (keyring) encryption

In order to implement a plaintext password file safe (keyring), while adhering to best Crypto practices today, I came up with this scheme: A user's master password is hashed with Argon2 (\$argon2id\$...
2
votes
0answers
246 views

Rijndael - is there some difference in resistance between counter in generator input and in IV?

I am thinking about Rijndael implementation in order to store tokens (cannot be hashed) - one token for one user. And finally I get stuck with key/IV generation problem :( The questions are: 1) Is ...
2
votes
0answers
381 views

AES OCB with Argon2 KDF for keyring file encryption

I've just released a python keyring companion package to encrypt the passwords in a file, available here. Description The project is mainly targeted to provide a sufficiently secure storage for ...
2
votes
0answers
653 views

How long does it take to brute force Blowfish-448?

I am conducting an investigation on the efficiency of AES and Blowfish with regards to memory when encrypting data of varying sizes. I open my essay with an introduction as to what encryption is and ...
2
votes
0answers
146 views

AES-128: How to find cipherkey comparing wrong and right ciphertexts?

I have a .mat file which contains 10 plaintexts and 10 ciphertexts which are correctly encrypted with AES-128 algorithm. It also contains 10 more ciphertexts which are wrongly encrypted. The fault is ...
2
votes
0answers
81 views

AES ECB one more experiment

I checked the most common AES modes and I think I got the goal of them: avoid same cyper text for same plain text. However all modes except ECB have the weakness that lost part of the message stream ...
2
votes
0answers
172 views

How to safely double-encrypt a secret?

Imagine two persons: Alice and Bob. We have a generated secret value that is valuable and has to be encrypted in a way that both can't reveal the value on their own but only when they both confirm. ...
2
votes
0answers
270 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
2
votes
0answers
340 views

total effective key length of the AESX-192

If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits. How should I compute the total effective key length of the ...
2
votes
0answers
89 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
2
votes
0answers
221 views

Where is the OID and ASN.1 specified for AES_CMAC?

I have a requirement to implement AES_CMAC as the authentication algorithm in a CMS library. I just can't seem to find the OID and the ASN.1 definition for it. I expected to see the OID under {joint-...
2
votes
0answers
112 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
2
votes
0answers
544 views

Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
2
votes
0answers
201 views

How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on AES,...
1
vote
0answers
50 views

I need to send 16 bytes using ECC keys on a resource-constrained device

I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware ...
1
vote
0answers
123 views

If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, ...
1
vote
0answers
54 views

Difference in the key schedule of AES for decryption given different orders of operation

As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable. ...