Questions tagged [aes]
AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.
2,655
questions
99
votes
1
answer
172k
views
What is the difference between PKCS#5 padding and PKCS#7 padding
One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
- 93.9k
91
votes
4
answers
106k
views
What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?
AES has several different variants:
AES-128
AES-192
AES-256
But why would someone prefer use one over another?
- 3,246
91
votes
5
answers
41k
views
Is AES-256 weaker than 192 and 128 bit versions?
From a paper via Schneier on Security's Another AES Attack (emphasis mine):
In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, ...
- 1,021
87
votes
5
answers
281k
views
How secure is AES-256?
The cipher AES-256 is used among other places in SSL/TLS across the Internet. It's considered among the top ciphers.
In theory it's not crackable since the combinations of keys are massive.
Although ...
- 1,065
79
votes
2
answers
184k
views
What is safer: ZipCrypto or AES-256?
Like in title: which one of these encryption methods (ZipCrypto, AES-256) is more secure and why? I am asking about it because I'd like to know which should be preferred when compressing files with ...
- 901
62
votes
6
answers
58k
views
Why is AES resistant to known-plaintext attacks?
At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
- 825
58
votes
5
answers
112k
views
What are the chances that AES-256 encryption is cracked?
I'm currently building a web application and would like to encrypt all data on the back-end. I was thinking of using the AES-256 encryption but wasn't sure how safe it was. I did that math and felt ...
- 699
49
votes
1
answer
110k
views
AES256-GCM - can someone explain how to use it securely (ruby)
I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
48
votes
2
answers
80k
views
AES CBC mode or AES CTR mode recommended?
What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
- 1,041
47
votes
2
answers
55k
views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
- 662
45
votes
2
answers
40k
views
AES-GCM recommended IV size: Why 12 bytes?
When using AES-GCM, a 96-bit IV is generally recommended. Most implementations I've seen also use 96-bit. However, I'm unsure on where this recommendation or convention comes from.
Let's assume a ...
- 553
43
votes
1
answer
52k
views
Ciphertext and tag size and IV transmission with AES in GCM mode
I am completely new to using AES in GCM mode of operation, and I have not a very large background in cryptography as well. I have been playing with OpenSSL trying to encrypt and decrypt some messages. ...
- 1,437
43
votes
2
answers
14k
views
Is AES-128 quantum safe?
I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones:
Can quantum attackers break ...
- 755
42
votes
3
answers
21k
views
Why does nobody use (or break) the Camellia Cipher?
If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice?
Why aren't there any breaks in Camellia? Does ...
- 1,192
41
votes
4
answers
8k
views
After 20 years of AES, what are the retrospective changes that should have been made?
I realize that this could be very opinion based, but I feel that there should be some solid information on AES at this point that could be referenced. After 20 years, I expect that there should be a &...
- 4,950
40
votes
2
answers
39k
views
Is AES-256 a post-quantum secure cipher or not?
We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take $2^{64}$ operations, not $2^{128}$).
That explains why we are using 256-...
- 417
39
votes
3
answers
11k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,485
37
votes
2
answers
14k
views
Why should I use an Initialization Vector (IV) when I have unique keys?
I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same.
I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
- 473
35
votes
2
answers
18k
views
Why is MixColumns omitted from the last round of AES?
All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
- 4,228
33
votes
2
answers
12k
views
7zip : Why does encrypting the same file with AES-256 not give the same output?
Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
- 463
32
votes
3
answers
89k
views
Why we can't implement AES 512 key size?
Out of curiosity why we can't implement AES 512 key size?
Please explain somehow i can understand! I'm not an expert.
- 521
31
votes
2
answers
6k
views
Blum Blum Shub vs. AES-CTR or other CSPRNGs
Following on from D.W.'s comments on a previous question, what properties does Blum Blum Shub have that make it better / worse than other PRNGs? Are there significant implementation difficulties or ...
- 3,547
30
votes
3
answers
5k
views
Dropbox Password security
Dropbox have recently published How Dropbox securely stores your passwords
Is this really more secure than using bcrypt with a complexity of 11 or 12 ?
The password "chain" is secure as its weakest ...
- 403
30
votes
4
answers
20k
views
Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512
Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
- 301
30
votes
4
answers
56k
views
What is the effect of the different AES key lengths?
How does a changing key length affects the ciphertext, not only in case of AES, but in general? I know that the key spaces become much larger and the number of rounds in case of AES changes, but is ...
- 387
29
votes
5
answers
11k
views
Why do wireless keyboards only use 128-bit AES? Why not 256?
I've looked for 256-bit AES encrypted wireless keyboards, and apparently they don't exist. Can anybody explain why this is from a cryptographic point of view?
Why wouldn't they just opt-in to the ...
- 309
28
votes
3
answers
10k
views
Plain text size limits for AES-GCM mode just 64GB?
Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB.
We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
- 1,717
27
votes
3
answers
2k
views
Why does BitLocker not use RSA?
If understand correctly from this post and the Wikipedia page for BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA encryption.
...
- 395
27
votes
2
answers
80k
views
How to solve MixColumns
I can't really understand MixColumns in the Advanced Encryption Standard, can anyone help me how to do this?
I found some topics on the internet about MixColumns, but I still have a lot of questions ...
- 1,737
26
votes
7
answers
6k
views
Does Terra Quantum AG break AES and Hash Algorithms?
According to this Bloomberg article:
A Swiss Company Says It Found Weakness That Imperils Encryption
Terra Quantum AG has a team of about 80 quantum physicists, cryptographers and mathematicians, who ...
- 49.3k
26
votes
2
answers
24k
views
How bad it is using the same IV twice with AES/GCM?
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP ...
- 1,437
25
votes
4
answers
40k
views
Is using the same IV in AES similar to not using an IV in the first place?
So if I understand how an IV works with AES, I'm supposed to generate a different IV for every message because using only a key, I will get the same encryption if the message was encrypted twice (...
- 353
25
votes
3
answers
41k
views
AES-GCM and its IV/nonce value
I was reading about the differences between the GCM and the CBC modes here and I have a follow up question:
In the CBC mode the person who performs the encryption is the one who provides the IV for ...
user114
24
votes
1
answer
6k
views
Why does AES have exactly 10 rounds for a 128-bit key, 12 for 192 bits and 14 for a 256-bit key size?
I was reading about the AES algorithm to be used in one of our projects and found that the exact number of rounds is fixed in AES for specific key sizes:
$$
\begin{array}{|c|c|}
\hline
\begin{array}...
- 343
24
votes
2
answers
6k
views
How exactly was the finalist chosen in the NIST AES competition?
I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen:
Unfortunately the NIST site is down so I can't gain further information ...
- 341
24
votes
2
answers
3k
views
Is GCM still recommended?
I stumbled across a forum thread where security researcher Thomas Ptacek
seemed to have negative feelings towards GCM. I had always thought from prior readings that GCM was the current gold standard ...
- 531
23
votes
3
answers
4k
views
Is there an AES identity key?
The following questions are of pure theoretical nature. I don't have an application in mind.
Is there a key that makes AES the identity function?
Is there a key that makes AES the identity function ...
- 335
23
votes
2
answers
19k
views
Does AAD make GCM encryption more secure?
Does additional authenticated data (AAD) make AES GCM encryption more secure? What if we drop AAD in AES-GCM 256? If we drop it, how will it make the encryption less secure?
- 343
23
votes
3
answers
6k
views
Known methods for constant time (table-free) AES implementation using 'standard' operations?
There are several known methods for implementing AES in constant time using SIMD operations, mostly based around fast byte shuffling (for instance Hamburg and Kasper/Schwabe). Are there any similar ...
- 1,724
23
votes
4
answers
86k
views
How long would it take to brute force an AES-128 key?
How long would it take to crack a AES-128 key using the most advanced technology currently available? The hardware can be anything, be it a high-performance CPU, GPU or even FPGA?
- 331
23
votes
1
answer
25k
views
Why exactly is Blowfish faster than AES?
I've not been able to understand exactly the reason behind Blowfish being faster than AES. Is it dependent on the block size? Or is it processor dependent? (if Yes, then lets assume that AES ...
- 233
23
votes
3
answers
24k
views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
- 560
23
votes
2
answers
4k
views
Design properties of the Rijndael finite field?
So we've already had a question on replacing the Rijndael S-Box. My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other words,...
user46
23
votes
1
answer
89k
views
What size of initialization vector (IV) is needed for AES encryption?
What size of initialization vector (IV) is needed for AES encryption?
I am using either CBC or CFB modes.
Knowing that AES is a sysmmetrical block-cipher algorithm with a 128-bit block size, I think ...
- 341
22
votes
3
answers
38k
views
How long does it take to crack DES and AES?
Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second.
How long would it take for to recover a DES key, ...
- 773
22
votes
2
answers
6k
views
Why is AES considered to be secure?
The security of RSA is based on the integer factorization problem, which is a very well defined and understood mathematical problem. This problem must be solved in order to fundamentally break RSA.
...
- 323
22
votes
1
answer
6k
views
Related-key attacks on AES
According to Wikipedia:
Related-key attacks can break AES-192 and AES-256 with complexities $2^{176}$ and $2^{99.5}$, respectively.
What are the requirements for these attacks (i.e how many ...
- 1,192
21
votes
1
answer
16k
views
Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)
Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size here)...
- 3,987
21
votes
3
answers
2k
views
Choice of multiplication polynomial in Rijndael s-box affine mapping
The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows:
We have chosen an affine mapping that has a very simple ...
- 13.2k
20
votes
4
answers
14k
views
Is there a standard for OpenSSL-interoperable AES encryption?
Many AES-encrypted things (files, strings, database entries, etc.) start with "Salted__" ("U2FsdGVkX1" in base64).
I hear it's ...
- 5,694