Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
1 vote
0 answers
193 views

RSA Key Generation & encrypted output using OpenSSL

When is it generally acceptable, if ever, to generate RSA keys without encrypting the PEM output with another encryption algorithm? I am working on a CI/CD process and want to leverage asymmetric ...
Johnny Bass's user avatar
0 votes
0 answers
120 views

Problem in matching AES CTR encryption and decryption with two different engines

I have a problem in combining encryption with a host software tool based on LibTomCrypt sources, then decryption with the hardware BEE (Bus Encryption Engine) of an i.MX RT1062 NXP processor. I am ...
Fabius Wiesner's user avatar
0 votes
1 answer
151 views

Do multiple keys mitigate Grover algorithm?

Grover, a quantum algorithm, weakens AES and ChaCha20. Is it possible to use multiple symmetric keys to encrypt a message multiple times to achieve 256-bit security for quantum computers?
Flan1335's user avatar
  • 361
0 votes
1 answer
176 views

How does AES-CBC encryption achieve non-repeating blocks of ciphertext?

I am very interested in encryption algorithms, especially AES encryption algorithm in symmetric encryption. To this end, I have studied a lot of theoretical knowledge about AES encryption algorithm ...
SN-Grotesque's user avatar
0 votes
1 answer
135 views

Implementing AES GCM but not getting correct output from cipher block

I'm implementing 128-bit AES-GCM (but only the encryption/AES-CTR aspect). When I set the Secret Key, Plaintext and IV to Test Case 2, page 27 of the GCM spec (see below) I get the wrong value for the ...
user997112's user avatar
0 votes
1 answer
126 views

AES GCM Difference between the IV and the Secret Key?

Below is part of AES GCM diagram. However, it only shows the behavior of the IV/counter. The GCM specification examples state both an IV and a Secret Key as two inputs. Can someone please explain ...
user997112's user avatar
1 vote
1 answer
222 views

What is Inverse equivalent (decrypt) in the AES specification examples?

Referring to the AES specification: https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.197.pdf Printed pages 35-37... The first detailed walkthrough is encryption, the second is decryption.... I don't ...
user997112's user avatar
2 votes
0 answers
107 views

AES key encryption on one time pad

I need to use the following scenario: There are 2 keys: AES-key and OTP-key (one-time pad). I encrypt the AES-key (as if it were plaintext) with an OTP key. Then I send the encrypted AES-key to ...
Ss1996's user avatar
  • 53
1 vote
1 answer
95 views

Understanding symmetric encryption security in relation to password-based key derivation

Here are some assumptions on which the question is based. If anything is wrong with this, please point this out straight away: Let's say I have a file I want to encrypt with AES256 symmetric ...
xsw2_2wsx's user avatar
2 votes
2 answers
395 views

Protecting against CPA for AES128/ECB by using padding

I was going to encrypt with AES, But I noticed ECB mode is not safe for CPA. So I thought about preventing CPA by padding input text to a multiple of 16 bytes. First, perform custom padding system: ...
kakacar's user avatar
  • 23
0 votes
1 answer
778 views

How to encrypt with CBC, step by step?

I have this message "Hello from another world" Can you explain how to encrypt it with CBC step by step? Are the message characters ...
Edward Akina's user avatar
1 vote
1 answer
92 views

Is AES distinguishable if the attacker has an decryption oracle?

Let the following game be given: G^IND-CCA': Prepare a key k <- KeyGen(1^Kappa) Choose a hidden bit h <- {0, 1} uniformly random Prepare a decryption oracle O_Dec. Given a cipher text c, it ...
Towdo's user avatar
  • 11
1 vote
1 answer
41 views

Can the IV be reused if the key is changed?

I am using AES-GCM-256 to encrypt data in a database, and am using a single key that I salt with a unique random value for each user to encrypt their information. I am using the same IV for all of ...
Darcy Sutton's user avatar
0 votes
0 answers
49 views

Sharing encryption key via intermediary without the intermediary having access to the content

Please bear with me... I want to store some data in an untrusted location (a server). I will want to share this with other people. I encrypt the data with AES encryption and a 20 character password. ...
amlwwalker's user avatar
1 vote
1 answer
175 views

Is it possible to use AES to produce a private ECC key?

I am working with hardware that can store an AES key securely--the hardware can perform AES encryption/decryption using a stored key without revealing the key to the caller. However, I would like to ...
Michael Cooper's user avatar
1 vote
2 answers
100 views

Can we find pairs $(c,m)$ with $f(c)=f(m)=true$ in $c = AES(m,K)$ with a fixed known Key $K$ significantly faster than brute force?

Different to the usual adversary use case we do not want to find the hidden key but instead pairs of $(m,c)$ which each fulfill a certain property $f(x)=true$ An example property could be e.g. 42 ...
J. Doe's user avatar
  • 453
0 votes
1 answer
80 views

Maximum Security of RSA

Table 2 of NIST SP-800 56B provides Estimated Maximum Security Strength of different modulus sizes. It means that RSA-3072 provides security of 128-bits at Max. Is it the case for symmetric algorithms ...
crypt's user avatar
  • 2,427
1 vote
1 answer
266 views

Chosen-plaintext attact on AES with MixColumns omitted

Jean-Philippe Aumasson' "Serious Cryptography" says: "Without MixColumns, changes in a byte would not affect any other bytes of the state. A chosen-plaintext attacker could then decrypt ...
Zyx's user avatar
  • 11
1 vote
0 answers
137 views

Should I implement a key store / key management system into my python library? [closed]

I've created a python library that uses both RSA and AES encryption to allow for hybrid encryption of text or images. I am wondering if I should implement a keystore and/or a better key management ...
Vey's user avatar
  • 11
2 votes
1 answer
138 views

Any simple, cryptographically secure AES-based DRNG?

I am looking for a DRNG/DRBG (cryptographically secure) algorithm/function (which I can program into js). I am looking to use a DRNG as a seed generator for generating multiple, identical AES keys on ...
Randusr's user avatar
  • 45
3 votes
2 answers
469 views

Is this property generally true for AES-128?

Let $E_{k}(P)$ be the AES-128 function with key $k$ and plaintext $P$, both 128 bits. I want to know if the following property is generally true for AES or if have I stumbled upon a special set of ...
hp2505's user avatar
  • 33
0 votes
1 answer
139 views

In AES-128-ECB, if byte 15 is over 128, the padding block changes value. What's the reason for this behavior?

For example, if we run this openssl command: openssl aes-128-ecb -a -in <(echo -n "AAAAAAAAAAAAAAAA") -K "deadbeefdeadbeefdeadbeefdeadbeef" ...
carleton's user avatar
  • 103
2 votes
2 answers
385 views

Designing a scheme to store encrypted data on a backend

My goal is to design an encryption scheme for the application so that the backend stores encrypted data and the whole process of encoding and decoding happens on the frontend. And you can be sure that ...
WardS's user avatar
  • 123
1 vote
1 answer
38 views

Symmetry shares

I’m sorry if this is already answered, however, regarding symmetric key components to create a symmetric key using xor (So eg comp1 xor comp2 xor comp3 = key) If in the case of an AES KEY, which goes ...
talisman's user avatar
1 vote
0 answers
33 views

CCM in the RUP setting reduced to CTR?

I have a question regarding the paper: Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014 (DOI: 10.1007/978-3-662-45611-8_6) AE schemes such as GCM [28] and ...
kaiya's user avatar
  • 143
3 votes
0 answers
136 views

AES subkey calculation not working for subkeys beyond 0 and 1

How should I generate the remaining keys when performing subkey generation in AES encryption? I generated keys 0 and 1 first, but the other keys I generated later were wrongly generated, so what steps ...
Mohamed Mohamed Mourad Abdel W's user avatar
1 vote
1 answer
242 views

What are the best known cryptanalytic attacks against AES-128 with 9 rounds?

What are the best known cryptanalytic attacks against AES-128 with 9 rounds? I found many such attacks on AES-192 and AES-256 with 9 rounds, but not for AES-128 with 9 rounds. Are there any ...
xhuliano's user avatar
1 vote
0 answers
58 views

By using a block cipher multiple times in a row is a 128-bit BC as secure as a 256-bit BC which uses his 128-key only as part of the message?

For given 128-bit numbers $S$ and $E$ we want to find a series of keys $k_i$ with $$ E = BC(BC(BC(.....BC(S, k_1),k_2) ..k_n)$$ We can either use a 128-Bit blocksize block cipher similar to AES (ECB ...
J. Doe's user avatar
  • 453
1 vote
2 answers
441 views

Is it safe to encrypt a message with AES-ECB two times?

Suppose we have a function that returns a chipertext of a known plaintext that has been encrypted twice with AES-ECB with two unknown keys, is it possible to get both keys ?
Andrea's user avatar
  • 13
1 vote
1 answer
92 views

How does the security of AES change if we allow multiple uses in a row? How does it change if we limit the key space? And introduce a filter function?

$$f_0 = A$$ $$f_{n+1}=AES(f_n,k_n)$$ $$f_i = B$$ For given 128-bit values $A, B$ we want to find a chain of suitable 128-bit keys $k_1$ to $k_i$. The total length $i$ is undetermined. Every valid key ...
J. Doe's user avatar
  • 453
3 votes
4 answers
493 views

Increasing Block Length of Symmetric Cipher

Triple DES (using an existing cipher 'DES' of key length 56bits) provides security of 112bits (although it requires key material of 168bits). Does there exist a mechanism to increase block length of ...
crypt's user avatar
  • 2,427
1 vote
1 answer
179 views

Is there a standard way of scrambling the output of AES?

So I needed symmetric encryption for my program. I landed on AES 192 bits in the CTR mode, because of some Computerphile videos on YouTube. After using it with the Node.js "crypto" lib ...
Rolands Laucis's user avatar
1 vote
1 answer
69 views

Is combining hybrid encryption with OTP worthy?

I'm considering a case when after hybrid encryption (AES Key encrypted via RSA) RSA key will be "splited" like in OTP. On the end one side gets encrypted AES key and "half" key RSA,...
ECHU's user avatar
  • 13
0 votes
1 answer
161 views

C Client AES 128 GCM encryption with openssl and server decryption inside Intel SGX with rijndael 128 GCM

I want to encrypt data on client side with Openssl AES 128 GCM and decrypt those data on server side inside Intel SGX using rijndael 128 GCM. I can see inside sgx_aes_gcm.cpp that it uses the same ...
gsoap's user avatar
  • 3
2 votes
1 answer
115 views

Is a single digital signature (ECDSA) of an encryption key (AES) enough to verify the legitimacy of all encrypted messages?

I have an encryption scheme set up with a client and server that utilizes AES 256. What I am curious about is whether or not all information sent from the server to the client can be verified as ...
Anonymous1121's user avatar
2 votes
1 answer
855 views

AES-GCM with HMAC

I am using AES-GCM to encrypt some data. I want every encryption to be done with a new random iv. For every encryption a new iv is generated and appended to the encrypted text to produce the cipher. ...
LUMPAAK's user avatar
  • 21
1 vote
1 answer
80 views

How new cache designs stop cache-based side channel attacks

How do new cache designs aid in defending against cache-based side-channel attacks? While conducting a side-channel attack, we have the T-table/S-virtual box's address. Normally, address mapping is ...
nivedita's user avatar
0 votes
1 answer
28 views

Best complexity of guessing some bits of AES-256 outputs

Suppose we have a plaintext $m$ and $|m| = 128$. Now suppose we know $l$ bit of the output $AES_k(m) = c$. What is the best complexity of guessing the rest $128-l$ bits of output with probability at ...
abbas's user avatar
  • 165
4 votes
1 answer
224 views

Can we change the irreducible polynomial of AES algorithm?

The AES algorithm uses the irreducible polynomial. Consider x^8+x^4+x^3+x+1 for multiplying with a MDS matrix for encryption ...
Bhargav - Retarded Skills's user avatar
4 votes
2 answers
256 views

Best complexity of guessing difference of AES-256 outputs

Suppose we have two plaintexts $m_1$ and $m_2$ such a way that $|m_1| = |m_2| = 128 $ and these two plaintexts are different just in one bit. Now suppose we know the value of $c_1 = AES_{k}(m_1)$($|k|...
abbas's user avatar
  • 165
1 vote
1 answer
310 views

Best attack estimates on AES

The wikipedia article on the Advanced Encryption Standard claims an attack against AES-128 with complexity $2^{126.1}$. The NIST call for proposals for post-quantum cryptography (table on page 18) ...
Myath's user avatar
  • 845
8 votes
1 answer
206 views

AES vs. SHA2 in key-stream generation

A KDF in Counter Mode (e.g., see NIST SP 800-108r1, Section 4.1, similar to HKDF) produces the output as what AES-CTR would do if one replaces AES with SHA2 (or, to be exact, with HMAC). However, NIST,...
uk-ny's user avatar
  • 128
1 vote
0 answers
69 views

Non-uniform plaintext distribution -- AES attack

Are their any attacks on AES (any mode) in which before the attack is mounted, the adversary is aware that the input distribution is non-uniform? Most of the work assume that the plaintext is ...
nivedita's user avatar
4 votes
1 answer
268 views

Why do nonce misuse resistant schemes mac the plaintext?

Choosing a proper nonce is a vital part of every symmetric-key encrypted communication, and it is mandatory that every encrypted message has a unique nonce. It can be shown that using a nonce twice ...
polfosol's user avatar
  • 201
0 votes
2 answers
56 views

Attack on AES/DES [duplicate]

Can we devise an attack on AES or DES (ECB mode) if we know just the distribution for the plaintext? For example, it is a English plain text -- we know what that would look like and the relative ...
nivedita's user avatar
5 votes
1 answer
322 views

Why are credits cards using 3DES instead of AES?

Why are credit cards using 3DES instead of AES? As far I understood, even DES3 is less secure than AES. Why it is still used? I searched already in the internet and forum to check out if it is ...
bilaljo's user avatar
  • 163
3 votes
1 answer
2k views

Max message length when encrypting with public key

The question is what is an appropriate public/private key length in order to encrypt a 256-bit or 512-bit AES key without wasting bytes, and whether long public/private keys provide meaningful ...
Per's user avatar
  • 185
2 votes
1 answer
615 views

Does encrypting data all at once or in chunks using the AES algorithm makes any difference?

Sorry if this is a duplicate but, to be honest, I don't even know how to search for an answer to it. I'm working in an environment in which I cannot use streams to encrypt data (React Native using the ...
Titus's user avatar
  • 123
3 votes
0 answers
140 views

AES first and last round key whitening

I've found this question from 2014 on Key Whitening: How exactly does key whitening manage to increase security? where is said that AES applies key whitening internally by adding a sub-key prior to ...
LianoQ's user avatar
  • 71
1 vote
0 answers
433 views

AES Decryption - Expand Key/First Roundkey

I am wondering how to use and expand keys during the Decryption. Let’s say we have an initial key (128bits): 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 So we get: w[0] = (61 62 63 64), w[1]=( ...
LianoQ's user avatar
  • 71

1 2 3
4
5
53