Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
0 votes
1 answer
88 views

Performance of AES NI using crypto++

I have following simple function ...
LWE-13's user avatar
  • 251
1 vote
1 answer
92 views

DTLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

It is DTLS 1.2 version question of this question. I know from 4.1.2.4. of RFC 5246 (DTLS 1.2) AEAD Ciphers can be used in DTLS 1.2 exactly the same with TLS 1.2. In TLS 1.2 AAD = seq_num + ...
Jounghoo Lee's user avatar
1 vote
1 answer
575 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
user946822's user avatar
0 votes
0 answers
59 views

Explanation of KeePass 2 database key calculation?

I am currently taking a course in university where we are working with a KeePass 2 database file. I am still very new to everything which has to do with encryption. First I am going to provide the ...
David Krell's user avatar
3 votes
1 answer
198 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
145 views

Is AES worse than OTP, if so is there proofs

My train of thought went, OTP is very secure if key is unknown because I am guessing the original message. AES on the other hand tells me I gave it the wrong key, and if I did I can just switch using ...
Lingling's user avatar
0 votes
2 answers
305 views

How are the iterations of the AES encryption algorithm determined?

All the knowledge I have learned about encryption algorithms tells me that the AES encryption algorithm uses three key bit lengths of 128, 192, and 256 to encrypt data, and these three key bit lengths ...
S-N's user avatar
  • 127
0 votes
1 answer
328 views

How to find the round key in AES 256

Can anyone explaine how to find the every 15 round key by the 64 hex digit master key of AES 256 please. I will be really greatfull
james's user avatar
  • 1
0 votes
0 answers
25 views

How does the round key work in AES 256 [duplicate]

Anyone can explaine to me how does the round key in aes256 work please, why is the round key 32 digit while 1 block only have 16 digit? how can 32 digit key XOR 16 digit block? Is it like two digit of ...
james's user avatar
  • 1
0 votes
0 answers
44 views

AES Ciphertext as key to another AES operation

I've this requirement to 'derive' a session key from an AES key that is stored inside a HSM. I don't want to mention which HSM since what I intended to do is to make the system HSM neutral. The ...
Chris Liaw's user avatar
0 votes
0 answers
32 views

AES S-Box design goal [duplicate]

First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
Mohammadsadeq Borjiyan's user avatar
0 votes
1 answer
206 views

Linear approximation table of AES S-Box

I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
Cat Dragon's user avatar
5 votes
3 answers
1k views

Theoretical Approaches to crack large files encrypted with AES

I have a large file (> 200 Gb), that I encrypted a while ago with AES-256-CBC. The file itself is a tar which I ran through ...
Sumuk Shashidhar's user avatar
1 vote
1 answer
72 views

Secure encryption in the presence of a keyservice

Imagine this scenario: On a particular PC is a service that provides cryptographic functions -- in particular AES-CBC and ECC (ECIES/ECDSA). The service provides access to a single key stored in an ...
Miral's user avatar
  • 113
1 vote
0 answers
79 views

How does changing one of AES encryption stages affect its security?

With regard to AES encryption on blocks, the next diagram showcase how does a change in one cell in the block (every cell is a byte) creates a change in encryption for ALL cells: Now I have the next ...
sadcat_1's user avatar
  • 111
1 vote
1 answer
126 views

AES CBC with random IV but key from PBKDF2 with same salt

TL;DR: Is encrypting data with AES CBC with random IV + PBKDF2 key using the username as salt safe? I have searched the internet, but I could not find a proper answer that encompasses the "AES ...
Daniel Aguiar's user avatar
4 votes
1 answer
213 views

How to determine cryptographic properties of AES S-Box?

In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
Cat Dragon's user avatar
0 votes
1 answer
185 views

If ChaCha20 only has 128 bits, is it secure?

ChaCha20 also provides 256-bit encryption, i.e, 2^256 possibilities of keys. But ChaCha20 is very fast, I think it provides at most 2^256 multiplied by decrypting time. 256-bit AES provides 254-bit ...
Flan1335's user avatar
  • 361
1 vote
0 answers
53 views

What happens if the column mixing in AES is replaced by simple XOR and subtraction? [closed]

This is https://github.com/kokke/tiny-AES-c The column mixing function in the AES algorithm implemented. ...
S-N's user avatar
  • 127
1 vote
1 answer
181 views

Where in the TLS 1.3 record is the sequence number located?

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
miran80's user avatar
  • 123
0 votes
1 answer
52 views

Why is IV in RFC8448 examples only 12 octets instead of 16?

I am working on manual decryption of application data in TLS 1.3 by going through example in RFC8448. I successfully derived and expanded key and IV, but the IV in examples is only 12 bytes long ...
miran80's user avatar
  • 123
1 vote
1 answer
734 views

Example of S-Box truth table in AES

I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say A boolean function S : $ GF(2^n) $ ...
Cat Dragon's user avatar
3 votes
1 answer
759 views

How does JOSE/JWE make use of ECDH when encrypting/decrypting messages?

Disclaimer: I first posted this question on security.stackexchange some minutes ago but deleted it, this is probably a better place for it. My goal is to use JWE with hybrid encryption (ECDH+AES) for ...
ceaaj's user avatar
  • 33
2 votes
1 answer
1k views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
0 votes
0 answers
36 views

How do different encryption schemes scale as a relation between their security parameter and computational requirement?

For example is it harder to break one 256 bit encryption than two 255 bit encryption for RSA and AES? For example, I understand that 256 bit RSA can be cracked in one minute according to this article [...
mnaei's user avatar
  • 1
5 votes
2 answers
117 views

How to prevent power analysis on software level?

When attacking RSA with Square&Multiply, one can figure out the secret key by looking at the exponentiation algorithm itself. To prevent this in software, we could use dummy multiplications after ...
user109190's user avatar
0 votes
0 answers
86 views

Is it safe to store AES-KW encrypted key in database?

Use Case: Web application accessed in browser. Registered users can store personal notes in the application, these notes are stored in a SQL database on a online server. The user can store unencrypted ...
user avatar
0 votes
0 answers
69 views

Password Manager desktop app

I have built a small password manager desktop app using python. This app falls under the master-password model.The app connects to two databases stored locally. The first database stores the users ...
StavrosN's user avatar
0 votes
0 answers
153 views

How to use NIST SP 800-22 to check randomness of 128 bits output in AES?

I am trying NIST SP 800-22 to test the randomness of 128 bit output in AES, but i always get igamc: UNDERFLOW or Segmentation fault (core dumped) error. My data file has 128 bit output format, for ...
Cat Dragon's user avatar
2 votes
0 answers
94 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
1 vote
1 answer
404 views

How long time per operation to crack Kyber1024 compared to AES256 for quantum computers?

How long time does quantum computers take per operation when search the key of Kyber? Grover's algorithm weakens 256-bit AES to 128-bit security, quantum computers at most take 2^128 operations to ...
Flan1335's user avatar
  • 361
2 votes
1 answer
80 views

How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?

I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows: Design criteria for $S_{RD}$. We have applied the following design ...
Cat Dragon's user avatar
2 votes
1 answer
144 views

AES encryption IV that won't need to be stored

I'm trying to implement an IV that won't need to be stored on it's own. I'm considering 3 options: Since I'm using PBKDF to generate a key I could use some bytes from the generated hash I could use ...
snow's user avatar
  • 23
1 vote
1 answer
42 views

Using Self-Generated Random Bits Instead of the Initialization Vector (IV)

I think my understanding on initialization vector (IV) might be lacking, but as I understand it, an IV is used to create randomness to an encrypted message so that the message is difficult to crack ...
Jarron's user avatar
  • 113
0 votes
1 answer
124 views

Finding block mode and key length from encrypted data

I have an AES encrypted data and the key, but I am not able to tell the block cipher mode [ECB|CBC|CTR] used in encryption or know the key length. Below is the encrypted data output in java. ...
Aviril Smith's user avatar
2 votes
1 answer
59 views

What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper. I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions ...
siba36's user avatar
  • 301
0 votes
1 answer
71 views

Use name as the initialization vector to encrypt passwords for users

I'm using AES-256-CBC to encrypt password for a set of users, and for each user in the database we gotta generate and store the password in the database. The ...
troubleddev's user avatar
0 votes
0 answers
36 views

Is it possible to generate a read-only key for a symmetrical encryption (AES)?

I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable, without the encoding key being exposed. This is the textbook use-case ...
Koray Kaya's user avatar
1 vote
2 answers
1k views

AES-GCM and tag length

Due to protocol limitations, I can put in 24 bytes of data only for tx (excluding headers), if I use AES_GCM for encrypting my data, I understand I don't need to worry about padding. For instance, if ...
EmbeddedEnthusiast's user avatar
0 votes
1 answer
62 views

Clarification regarding AES-CTR

I was recently trying to perform a AES-128 CTR Encryption and Decryption. I had a observation that if a AES-CTR encrypted value is encrypted again (with same key and Iv) it results in the plain text ...
gabbar's user avatar
  • 1
2 votes
1 answer
40 views

Threshold of resistance against Linear Cryptanalysis

In the AES proposal, the last sentence on page 30 it is said: To be resistant against LC, it is a necessary condition that there are no linear trails with a correlation coefficient higher than 2^(n/2)...
Abdelrahman's user avatar
4 votes
1 answer
77 views

Where did the number of initial plaintexts required for impossible cryptanalysis on Mini-AES came from?

I'm implementing impossible differential cryptanalysis on AES and I've started with implementing it on mini-AES to fully understand the process using R.Phan's paper as a reference. But I don't ...
siba36's user avatar
  • 301
1 vote
2 answers
99 views

Encrypting Small messages (BLE Beacon) - with little entropy - symmetric [closed]

I want to encrypt Bluetooth Beacon data. I was wondering if having very little entropy in the clear text would make the key easier to guess? The maximum data length is 31 bytes An example of the data (...
BAO's user avatar
  • 13
6 votes
3 answers
9k views

Can Quantum Computers crack RSA and AES?

Im trying to learn more about cryptography and ran into a post, Is AES-128 quantum safe?, which asks if AES-128 is safe. From the articles and replies it seems that AES-128 (symmetric key) is safe ...
cryptoman534345's user avatar
1 vote
0 answers
76 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
Luce's user avatar
  • 11
2 votes
1 answer
85 views

When the input size in a PRF is larger than the output and many inputs will generate the same output, but why AES-256 in CTR mode is considered safe?

I know that if the input size in a pseurandom-function is larger than its output, many different inputs will generate the same output by the Pigeonhole principle (I also read an article related to ...
alpominth's user avatar
  • 393
2 votes
1 answer
88 views

In AES, why do we multiply the columns by a polynomial with a repeating coefficient?

In the MixColumns step of AES, one multiplies each of the columns of the $4\times 4$ box of bytes by the polynomial $a(x)=\{03\}x^3+\{01\}x^2+\{01\}x+\{02\}$ (modulo $x^4+1$). But in this polynomial, ...
Joseph Van Name's user avatar
2 votes
1 answer
337 views

Is it possible to reverse GHASH from GCM?

How can I create a "reverse" GHASH algorithm for GCM that allows me to compute an input value that generates a specific chosen output, given that I know the authentication key H? If this is ...
sWong's user avatar
  • 29
2 votes
1 answer
273 views

Application firmware sign-then-encrypt vs encrypt-then-sign

I know that there are previous questions on the subject e.g. here, however I would like to ask it for my particular (simple) case. I have an application firmware that is downloaded to a microprocessor ...
Fabius Wiesner's user avatar
3 votes
1 answer
99 views

GCM-SIV vs CBC with fixed IV?

I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
Paul's user avatar
  • 31

1 2
3
4 5
53