# Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

2,021 questions
Filter by
Sorted by
Tagged with
51 views

### how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
94 views

### Can you defeat AES-CTR's birthday boundary with a 2nd AES?

This follows on from How do I produce a stream of secure random numbers from AES-Counter mode? Consider then the generator:- $$\operatorname{AES_{k1}}(n) \oplus \operatorname{AES_{k2}}(n)$$ ...
180 views

### Retreive secret key and IV knowing the plaintext and ciphertext?

If I use AES-128 in CBC mode, and I know the plaintext, ciphertext, and length of the plaintext padding, which is 15, can I retrieve the key and IV, using brute force or some special techniques?
121 views

### Explain mixing bijection with an example

I am reading whitebox AES. "Mixing Bijection" is one of the important definition. For example, I copy one paragraph here: The look-up tables that incorporate bytes of round keys can be considered ...
423 views

### How to generate whitebox AES decryption algorithm and code, with existing WB-AES encryption code?

I can find several whitebox AES 128 implementations on Github, such as wbaes-1, wbaes-2, wbaes-3, etc. All of them are developed based on WB AES encryption. Ideally, most implementations include two ...
98 views

### What encryption shoud I use for single char encryption?

I'm very new to encryption and I wanted to know if it is secure or just possible to use encryption on single chars. I did some research, but nothing to clear and i'm a bit confused. The modes I think ...
79 views

### how are variable key sizes produced?

I am current learning the internal working of several Symmetric key Cryptographic algorithms, and came across DES and AES. DES takes in input a 64 bit key and AES-128 takes in input a 128 bit key ...
33 views

### Collision Security

Question concerning collision issue in CBC-mode: If we are using CBC mode with AES for 1 message, the birthday paradox indicates that we risk a collision after 2^(n/2) so 2^64 plaintext of 128 bits of ...
225 views

### Encrypt UDP packet with time-generated encryption key

I'd like you to help me solve a dilemma of mine. I am currently building a home automation from scratch for my next house. The basic gist of it is that I will send UDP packets over a local network. ...
1k views

### AES-GCM cipher - Nonce vs IV

I am using a Python library called PyCryptodome, which offers the following API for AES-GCM ciphers: https://pycryptodome.readthedocs.io/en/latest/src/cipher/aes.html As you see, IV is not ...
81 views

### AES encryption question

If we consider the generation of keys as \begin{aligned} K_0 &= E_K(IV); \\ K_{i+1} &= E_{K_i}(A) \end{aligned} Where A is a block of zeroes, and the ciphertext blocks are computed as ...
840 views

### How are these AES MixColumn multiplication tables calculated?

I'm using the mul2, mul3, mul9, mul11, mul13 and mul14 tables for the MixColumn and InvMixColumn steps in AES-128. However, I got these off some Github repository, and now I'm looking for an actual ...
161 views

### aes invmixcolumns process? [duplicate]

I want to know how to obtain mixcolum -> invmixcolumns mixcolumn = [2 3 1 1 1 2 3 1 1 1 2 3 3 1 1 2 ] -> -1/35 [4 3 11 17 17 4 3 11 11 17 4 3 ...
859 views

### What happens if you increment MAX counter in AES-CTR?

Suppose you use a IV/counter = ffffffffffffffffffffffffffffffffin AES-CTR. What will happen if you encrypt the next block, and thereby increment the counter by one? ...
290 views

### How does ECDHE fit with AES and SHA?

Hi I'm trying to piece together how AES, ECDHE, and SHA all work together. From what I understand ECDHE is uses asymmetric cryptography to generate a shared key from a public and private key which are ...
478 views

### Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
228 views

### AES with no SubByte - recover the key

I was wondering if it was possible to recover an AES-128 blockcipher key, knowing that there is no substitution box (it can be seen as the identity mapping). I thought it would be feasible. I ...
747 views

### In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo? [duplicate]

I want to change some encryption options while using GnuPG to encrypt a file symmetrically. 1) However, for choosing the cipher algorithm, GnuPG has two commands and I don't know which one to use. ...
170 views

### Best practices when encrypting a file with three different ciphers [closed]

I have some files that contain important information, so I want to encrypt them by the most secure encryption method possible. I've read countless StackExchange answers on similar questions and some ...
786 views

### Ways to make white-box cryptography AES implementation more difficult to be broken

Background: I want to use white-box cryptography to hide the keys stored in a client application. I am looking for existing implementations of white-box cryptography, such as AES 128 or 256. But I ...
168 views

### How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
950 views

### Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes?

Does ChaCha20/Salsa have the same bit strength as AES for identical key sizes? In other words, does ChaCha20 with a 128-bit key theoretically require 2^128 attempts to brute force, as with AES-128? ...
270 views

### Cipher Block Chaining - How do you change the plaintext of all blocks?

I've just read about CBC encryption and decryption and was wondering how you can change every plaintext block? Let's say you have an initialization vector, 3 ciphertext blocks, know each block-cipher-...
90 views

### LoRaWAN 1.0.2 Session Key Security

I am reading about LoRaWAN 1.0.2 specification. For the confidentiality and integrity of the comunication the protocol generate two session keys, the NwkSKey and the AppSKey (part 6.2.5 of the ...
58 views

### Can $AES_{k1}(m)$ be equal to $AES_{k2}(m)$? [duplicate]

Context: We have a generic bloc cipher composed of an encryption function $E_k$ and a decryption function $D_k$ operating on blocs of $n$ bits. For a key $k$ fixed, we can see $E_k$ as a pseudo-...
336 views

### Is there a maximum amount of data which can be encrypted using a symmetric (AES256) key?

I am working on an application where we will be encrypting billions of small (< 2,000 bytes) records. Combined, we are facing many TB of data. Each record will be encrypted independently, using a ...
640 views

### AES reverse Rijndael key schedule with decryption round keys

I want to get the original encryption key (32 byte) of AES 256 (CBC) implementation. The implementation has the values of the inversed round keys values hard coded into the decryption function. I ...
117 views

### Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?

I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature: ...
68 views

### Acceptable points of failure when applying encryption in an application [closed]

I am working an a Windows application that will encrypt and decrypt files using AES Encryption. The 32 byte key which is diversified and derived using a ATSHA204 unique serial number and some addition ...
178 views

### How to find multiplicative inverse of a hexadecimal number in the finite field GF(2^8)? [duplicate]

I am new to cryptography. As I was reading a note regarding S-box construction, I found a step mentioning multiplicative inverse of a number in the finite field GF(2^8). I couldn't understand it!! Can ...
59 views

### Does GCM improve the strenght of weak passwords?

If I am encrypting a file with GCM/AES256 with a weak key (say a sha256), does the fact that it takes time to brute force a long message improve my security? Example: I use the sha256 of "ARainyDay" ...
105 views

### Difference with round keys and round constant in AES

I am confused with round keys and round constant in AES. Are they the same? Can someone explain it to me?
43 views

Say an attacker has access to a non-rate-limited API that takes (IV, data) and outputsAES-CBC(key, input, data), with the key ...
871 views

### Why does BitLocker not use RSA?

If understand correctly from this post and the Wikipedia page for BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA encryption. ...
96 views

### Protocol Design for IoT devices having PSK using AES-GCM

Handshake: 1) Client To Server: "AES-GCM(Client_random_128bit,client_iv,psk),client_id,tag,client_iv" 2) Server To Client: "AES-GCM(Server_random_128bit,client_iv++,psk),tag ...
35 views

### How many bytes of the last keystream block are used to XOR the final block of partial plaintext in CFB, OFB & CTR modes?

I apologize if this is a dumb question but I'm trying to understand how the final block of partial plaintext is XORed using only n number of bytes in the final keystream block. How do we determine ...
99 views

### How to implement correctly a “secure” authentication protocol? [closed]

Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application. As I am concerned the system ...
328 views

### How to implement correctly an Integrated Encryption Scheme?

I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
86 views

2k views

### Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

I could generate a random nonce and prepend it to the ciphertext, but storage space is at a premium and the only constraint AES-GCM has on the nonce (if I'm reading correctly) is that the same nonce ...
86 views

### I need help determining the best encryption options based on System.Security.Cryptography in .NET

I asked a question here, and received a great summary but was redirected here. Covering the answers of the post, it was noted and suggested that: Use of plain (CBC) mode. They suggested to use GCM ...
267 views

### AES, CMAC and “3 pass authentication protocol” Explained

I am struggling a bit to understand how authentication systems are properly used in NFC tag environments so I'm posting this thread to clarify some concepts.(In advance, this is not my field, so ...
55 views

### AES: Why ShiftRows() before MixColumns()? [duplicate]

In above picture you can see a AES state array over 2 rounds through the S- and P-Boxes of AES. It's taken from here and intends to show how 2 rounds of transformation are necessary to achieve full ...
98 views

### The small key-search circuit for brute-force of Bernstein

I'm trying to understand Understanding brute force by Bernstein. I couldn't understand how the described machine can brute force the AES. The attacker builds a very small key-search circuit. The ...
377 views

### What's the reason for Monte Carlo tests for block ciphers?

NIST specifies that implementations were required to create Monte Carlo test vectors for ECB and CBC mode for the AES competition. What's the reason for these tests? The only thing I can think of is ...
305 views

### Inconsistency with PKCS#11 v2.40 CKM_AES_KEY_WRAP_PAD

There appears to be some inconsistencies between the PKCS#11 v2.40 Current Mechanism Specification and the specification for AES Key Wrap Pad as defined in SP800-38F. First, according to PKCS#11: ...
110 views

### Weak/Vulnerable AES Implementations [closed]

I'm trying to complete a cryptography CTF challenge in which I have a cipher I'm supposed to attain the original plaintext from. I have reason to believe it's been encrypted using AES, but I'm unaware ...
66 views

### AES: Given two deterministic plaintexts, compute two keys let the ciphertext is the same, is it possible?

Given two plaintexts $p_1$ and $p_2$, is it possible to find two keys for AES(-CBC) so that $$E_{k_1}(p_1) = E_{k_2}(p_2)$$ I want to make sure that will never happen, or is there any way to ...
3k views

### AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password ...