Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
2 votes
1 answer
276 views

Choosing (key,plain) to produce zero state in middle rounds of AES encrypt

I was told in passing that (key, plain) pairs could be chosen to produce a zero state in AES encrypt in some middle round (say 5). [The application here being to side-channel leakage assessment.] ...
yoyo's user avatar
  • 420
0 votes
1 answer
130 views

Possible to encrypt message without knowing recipient public key?

Assume Bob is sender and Alice is future recipient. In ideal situation Bob know Alice public key, and encrypt message with it. But what if Bob don't know Alice public key (he only will know Alice ...
byXrom's user avatar
  • 3
0 votes
1 answer
97 views

CBC KEY recovery when KEY=IV

We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server? ...
Sahar's user avatar
  • 3
2 votes
2 answers
105 views

Using the MAC to verify if Cipher Only attack has succeeded

I am working on an experiment to compare the efficiency of brute-force attacking block ciphers like AES and DES with reduced key sizes for different programming languages and library implementations. ...
Matt's user avatar
  • 21
1 vote
0 answers
81 views

Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
LightTunnelEnd's user avatar
1 vote
1 answer
136 views

Does using multiple encryption algorithms with different keys on the same cipher text improve security?

I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
bismofunyuns's user avatar
0 votes
1 answer
99 views

How to evaluate the minimum complexity of the key recovery when the success probability p is given?

Since the practical security of a symmetric-key primitive is determined by evaluating its resistance against an almost exhaustive list of known cryptanalytic techniques. My problem is that could we ...
HelloSpace's user avatar
0 votes
0 answers
145 views

CBC Predictable IV Help

I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
drift's user avatar
  • 1
0 votes
1 answer
169 views

Advantages of AES vs XOR on a plain text file

Currently, I am using AES-GCM to encode and decode a plain text file. The key is derived from a plain text password using PBKDF2 and a random salt with SHA-256. However, I have been thinking and came ...
Hubert's user avatar
  • 1
1 vote
1 answer
209 views

Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?

This is a follow up question to: Bit Flipping Attack on CBC Mode which demonstrates that a bit flipping attack with a known IV is possible on CBC mode. Is it safe to assume that the bit flicking ...
user avatar
1 vote
0 answers
65 views

Weaknesses of AES-GCM [duplicate]

Besides the limited nonce size of 96 bits, are there any other weaknesses to the GCM mode of AES? I am creating a password vault and am trying to narrow down my options of encryption schemes. Also, is ...
Bismofunyuns's user avatar
0 votes
0 answers
23 views

Decrypting AES-128 with known regularly spaced single byte value [duplicate]

How would knowing a clear byte value of the decrypted data affect a brute force attack on an AES-128 encrypted message ? i.e. If I knew the 1st byte should decrypt to 0xff OR I knew that every 100 ...
D.Price's user avatar
0 votes
0 answers
152 views

AES-GCM with a fixed IV but a random "wrapped" key

It is well-known that AES-GCM requires the IV to be unique for each message that is encrypted with the same key. If the IV ever repeats, with the same key, then AES-GCM fails catastrophically. Now, ...
pogoya9172's user avatar
1 vote
2 answers
272 views

Hamming Distance and Avalanche effect in Cryptography?

I am new to Cryptography and I know there are better ways to test a cipher's effectiveness out there but in this case I am trying to test a cryptographic algorithm's(AES,xchacha20,twofish) hamming ...
Jake's user avatar
  • 43
0 votes
0 answers
58 views

AES-ECB attack encryption audio fie

I got two audio files one is encrypted and the other file is a part of the plaintext. I want to extract all the plaintext. I am using the AES-ECB mode, the size of the block is 128 bits and the start ...
mahouuuuuuu's user avatar
3 votes
1 answer
369 views

Is there any way to measure entropy of encryption algorithms in python?

I am new to cryptography and I am trying to find a way to measure ciphertext entropy of encryption algorithms such as AES, Chacha20, etc for a school project. Is there any way to do it on Python? I ...
Jake's user avatar
  • 43
0 votes
0 answers
42 views

How to make sure that $S$ & $S^{-1}$($S$ inverse) is a permutation of bytes?

Assume you have implemented the S-box and Inverse S-box of AES as code (or hardware) instead of a lookup table copy-pasted from the AES standard. An obvious test you want do is to check that S−1(S(B)) ...
Ali's user avatar
  • 1
0 votes
0 answers
30 views

Writing a specific position of AES state in a specific round in terms of Key bytes

Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the ...
Mohammadsadeq Borjiyan's user avatar
1 vote
1 answer
93 views

Is it possible to use two different engine to encrypt/decrypt data with AES GCM?

I'm confused about something that makes AES GCM great. It uses MAC to sign data it encrypts. I also uses nonce. But lets say I encrypt data in software A. Software A produces a ciphertext and a tag as ...
tommy lee's user avatar
0 votes
1 answer
82 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
1 vote
2 answers
3k views

How weak is using AES with a 128 bit key but 64 bits of the secret key are public constants?

Respected community, I was wondering how weak would AES-128 be, if we provide only a 64 bit key with the other remaining 64 bits either zero bits or public constants, known to the attacker. Is it easy ...
Aravind A's user avatar
  • 1,020
2 votes
1 answer
218 views

AES GCM iv/nonce length under 12 bytes in java [duplicate]

I'm developping an Swift app that communicate with a Java legacy backend using AES GCM, my biggest problem is that Java let you use a 8 bytes iv/nonce (and the legacy code is written with 8 bytes ...
Pierre Berget's user avatar
0 votes
1 answer
71 views

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto

Can we have an asymmetric key in AES? Clarification about PBKDF2 and AES-GCM in WebCrypto According to wikipedia AES page, AES is a symmetric-key algorithm. The algorithm described by AES is a ...
borracciaBlu's user avatar
0 votes
0 answers
43 views

Java AES T-Tables Implementation

I am trying to implement an encryption function that uses the AES T-Tables implementation. I am quite sure that my roundKeys are correct. I also know that the initial round key addition in the ...
schegga_BC's user avatar
2 votes
3 answers
692 views

Check if encrypted text is equal without decrypting or doing heavy calculation - AES

I implemented AES128-CBC algorithm and what I need is to be able to compare encrypted text without decrypting. Is the only way to use static or no iv to achieve this? . Any ideas? Use in code -...
FSDev's user avatar
  • 23
0 votes
0 answers
53 views

2 XORed AES-ECB ciphertexts, zero key and piece of plaintext

I have $C_1 \oplus C_2$ where $C_1$ = $AES128_k(P_1)$ and $C_2$ = $AES128_k(P_2)$. I know the k, it is 0 (i.e. 16 bytes of zeros). I know the piece of $P_1$ (7 ...
stefan09's user avatar
1 vote
1 answer
81 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
2 votes
2 answers
994 views

Obsidian.md's "end-to-end" encryption & privacy

Obsidian.md claims End-to-end encryption means that the data is encrypted from the moment it leaves your device, and can only be decrypted using your encryption key once it's back on one of your ...
scr4tchy's user avatar
1 vote
1 answer
158 views

What is the probability of decrypting AES-128-ECB if some of the information is available?

There is a JSON array like this: ...
accountnujen's user avatar
0 votes
0 answers
57 views

Implementation of Ring Signature

I have implemented a ring signature in a Python program, To keep it simple, I have Alice and Bob. Based on this ring equation: $$ v = E_k(y_s⊕E_k(y_i⊕v))$$ I will get: $$ y_s = E_k^{-1}(v)⊕E_k(y_i⊕v) \...
bjpo027's user avatar
  • 11
1 vote
1 answer
48 views

Does any encryption/decryption algorithm supports linear decomposition?

I am not sure whether "linear decomposition" is appropriate to summary my question: We know that the traditional symmetric encryption/decryption algorithm (like AES, TDES) can be written as: ...
ZKM's user avatar
  • 13
1 vote
1 answer
84 views

Newbie question about AES-GCM and IV

Imagine a channel where the initial secret for deriving of the actual key is established with ECDH. First, that shared secret is used to derive a temporary key with some default parameters (salt, ...
Kote Isaev's user avatar
0 votes
1 answer
76 views

How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?

I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data. It's a black box challenge, but managed to figure out the ...
Sir Muffington's user avatar
0 votes
1 answer
93 views

Key expansion in AES CTR mode

While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption). Does AES CTR mode also requires such a step ? Or can the 256 ...
shaiko's user avatar
  • 103
0 votes
1 answer
396 views

Some questions about AES-128 key wrapping using RFC3394

It's that time of the year - I'm trying to learn how AES-128-CBC encryption works. My key is (since it's AES-128) is 16 bytes, my IV is 16 bytes as well. My implementation of key wrapping does ...
Sir Muffington's user avatar
1 vote
1 answer
498 views

How does the Key Expansion Step Work for AES-192

I now understand the initial key from all the round keys will be the original 4x4 block for 128-bit keys, but I do not know how it would work for something else, like AES-256 or 192. Would it be that ...
Epicko Corporation's user avatar
2 votes
1 answer
218 views

Can I predict CryptGenRandom on my own device?

I have a Windows 10 laptop with an algorithm that creates a random number using the PRNG CryptGenRandom. According to Wikipedia: Because CryptGenRandom is the de facto standard CSPRNG in Win32 ...
Riemann's user avatar
  • 221
1 vote
2 answers
333 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 343
2 votes
1 answer
269 views

Is it possible to reverse engineer an encryption algorithm derived from AES-128 given these conditions?

Given the following conditions: The encryption program, which uses some algorithm resembling AES-128 but with unknown modifications to real AES-128. It uses a fixed key and IV. It is written in Rust ...
Sir Muffington's user avatar
2 votes
1 answer
758 views

CTF - AES Padding Oracle [closed]

I am trying to solve another CTF challenge. The challenge consists in trying to exploit an oracle that decrypts any hex text we send (see code below). I am kind of stuck on this one as this is not a ...
Shark44's user avatar
  • 145
2 votes
1 answer
420 views

What is the correct way to use HKDF with X25519?

I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF. Initially, I ...
Eri's user avatar
  • 31
0 votes
0 answers
9 views

LoRa Cloud PIN derivation according to 'smtc0' algorithm

I am following the steps in LoRa Cloud in order to derive the PIN value using the Algorithm smtc0 (https://www.loracloud.com/documentation/join_service?url=derivation_schemes.html). I don't quite ...
user110681's user avatar
3 votes
1 answer
509 views

Weird padding in Crypto.Util.Padding.pad() function in python

I'm trying to pad some plaintext to be a multiple of 16 bytes to use it as input in AES ECB block cipher. ...
Ahmed Mohamed's user avatar
2 votes
2 answers
128 views

Recommended way to generate a key and IV for CFB mode?

I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
Jonathan Wilson's user avatar
0 votes
0 answers
1k views

AES CBC - Find IV (CTF)

I am currently trying to solve a training challenge based on AES with CBC. This is the infos I'm given: ...
Shark44's user avatar
  • 145
0 votes
0 answers
65 views

Hybrid encryption parameters when using elliptic curve keys

I wrote a command line application for encrypting/decrypting files to your local machine. The idea is you have an asymmetric key pair where the private key is stored encrypted and the public key is ...
Samuel Amantea-Collins's user avatar
0 votes
1 answer
106 views

Has AES some keys which are related to each other? e.g. $\forall m: AES(AES(m,k1),k2)=AES(AES(m,k2),k1)$ or $AES^n(m,k1)=AES(m,k2)$. How to find them?

Do $\exists $ keys $k_1, k_2$ which given any (128-bit) message $m$ are related to each other by being commutative to each other with $AES(AES(m,k_1),k_2)=AES(AES(m,k_2),k_1)$ $\forall m$ and ...
J. Doe's user avatar
  • 453
2 votes
2 answers
140 views

AES security: how many rounds we need to fall the differential probability below 2^(-128) in the case of that branch number is 3

In AES, the MixColumns operation involves a linear transformation from GF(2^8)^4 to GF(2^8)^4. The branching factor for this transformation in the original AES is 4, and it is considered secure ...
Haruto Kimura's user avatar
2 votes
0 answers
59 views

Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?

I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
cmdruid's user avatar
  • 21
0 votes
1 answer
30 views

AES GCM representation of lev(IV) in IV padding to compute ICB

I have a question regarding understanding representation of length in AES-GCM while doing padding for the IV to calculate ICB/J0. In the aes GCM test vectors testcase5 I see the IV is of length 8 ...
sg777's user avatar
  • 367

1
2
3 4 5
53