Questions tagged [aes]

AES (Advanced Encryption Standard) is a symmetrical block-cipher algorithm with a 128-bit block size, and key sizes of 128, 192 or 256 bits.

Filter by
Sorted by
Tagged with
8
votes
1answer
2k views

What is 'security margin'?

I have been academic papers about Rijndael, Serpent, and Twofish, and there is this term that is vague to me. I cannot find a tangible definition in google. Can someone briefly define, describe, and/...
8
votes
1answer
584 views

How to enhance randomness of AES?

I'm using PHP to encrypt a string and Java to decrypt it on a remote server. To perform the encryption, I'm using the strategy that can be found here. My problem is that the strings I encrypt are ...
8
votes
1answer
4k views

TLS 1.2 Cipher Suites With AES-GCM – What data (if any) is passed to the AES-GCM cipher as the Additional Authentication Data?

TLS 1.2 defines a number of cipher suites that employ AES-GCM, e.g.: ...
8
votes
1answer
5k views

Is ChaCha20 safer than AES with respect to side-channel attacks?

I've already seen some topics on this matter, but I feel like my question hasn't really been answered. Given the following: AES must be implemented in hardware (i.e. using the AES-NI instruction set)...
8
votes
2answers
6k views

AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ? (The obvious answer would be "...
8
votes
1answer
356 views

Branchless AES Implementation

Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks? Is it even true, ...
8
votes
2answers
2k views

AES encrypting multiple files

So if I want to encrypt all the files in a folder with AES (same password) I take each file and generate the key schedule using PBKDF2. As the PBKDF2 algorithm takes in a salt then this salt should ...
8
votes
1answer
7k views

Advantage of AES(Rijndael) over Twofish and Serpent

I'm trying to figure out a suitable encryption technique and after reading a bit, I figured the current AES 128-bit encryption is suitable for what I'm trying to do. However, this is more due to the ...
8
votes
1answer
2k views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
8
votes
1answer
1k views

CBC key lifetime, or, "how big is too big?"

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
8
votes
1answer
904 views

AES and DES - reusing the same round keys

Both DES and AES use key expansion to generate the round keys (for Feistel network or for the AddRoundKey operation). Each round uses a different key. Why do we need that? Why we cannot use the same ...
8
votes
2answers
902 views

How to check that AES Matrix is MDS?

I want to understand how can I prove that M matrix in AES is MDS. I know that a matrix is MDS if every determinant of every square submatrix is different from 0. I don't get this. How much submatrix ...
8
votes
1answer
9k views

How long does it take a quantum computer to brute force AES?

I understand that using Grover's algorithm it only requires $2^{64}$ lookups for a 128 bit AES encryption, leading people to say we need to increase to 256 bit keys. But how long would it actually ...
8
votes
1answer
2k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible. In the paper, the ...
8
votes
1answer
2k views

Effect of ESSIV when used with XTS

I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question. When formatting a partition to use LUKS, the two most common ...
8
votes
1answer
2k views

Why is the polynomial in AES MixColumns multiplied modulo a reducible polynomial?

I know that the AES MixColumn step is calculated as follows $b(x) = (a(x)c(x)) \mod l(x)$ with $a(x)$ being the column to encode, $c(x)$ the fixed polynomial $c(x) = 3x^3 + x^2 + x + 2$ and $l(x) = ...
8
votes
1answer
917 views

Tiny Firmware Authentication

I am developing a product based on the NXP LPC11C24 microcontroller. It will communicate with PC software to perform its work. I am attempting to build a secure firmware update functionality. The PC ...
8
votes
1answer
558 views

Detection of weak keys for AES-GCM

There are many papers out there that show that a message authenticated and encrypted by AES-GCM can be forged if the used key is weak (e.g. by Handschuh and Preneel, Saarinen or Procter and Cid). With ...
8
votes
1answer
793 views

What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

Studying AES on Wikipedia, I noticed a statement regarding some ongoing studies on the use of Kendall's Tau coefficient in cryptanalysis: According to the Snowden documents, the NSA is doing ...
7
votes
4answers
4k views

When will AES be "upgraded"?

AES is secure, but compared to other encryption algorithm which are marked as secure, it's slow. For example, ChaCha20 is faster than AES, but still secure. Also other standard-algorithms like SHA ...
7
votes
3answers
9k views

Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?

Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode. Can I recover that key? If, how big does the list of plaintext ...
7
votes
2answers
24k views

What is the maximum key size for a 128 bit AES?

What is the maximum key size for AES 128, Will using a key greater than maximum gives extra security or error? Is there a minimum key size? Suppose a key is 128 bit, does it means The key is of ...
7
votes
2answers
5k views

Does AES specify error messages when using the wrong password to decrypt?

I am writing a small program which uses AES. In testing it with wrong passwords, I get error prompts from Microsoft C# component saying "the padding is bad"; whereas I expect wrongly decoded texts. Do ...
7
votes
2answers
2k views

Implement AES-CTR on top of AES-ECB

I using a microcontroller which only support AES-ECB encryption i.e. no decryption-mode, CBC, GCM or similar modes. However, I'm wondering if it's possible to implement AES-CTR or similar on top of ...
7
votes
1answer
5k views

AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

I'd like to encrypt Text with AES/CTR and a password defined by the user in java. I already checked the internet (and stackoverflow) for answers. The most used version is to hash the user password ...
7
votes
2answers
25k views

AES vs RSA - Which is stronger given two scenarios?

Let's say we have some plaintext. Let's say that we encrypt this plaintext with a random 32 byte key using AES-256. Let's say that we also encrypt this plaintext with an RSA 2048 public key. If only ...
7
votes
5answers
4k views

RSA-4096 vs AES-256 for secure chat application?

Which of these two methods suits better the implementation of a secure chat application? In this context, chat will be limited up to 150 letters for one message. I would prefer RSA because what I know ...
7
votes
5answers
13k views

Why don’t all AES encryption tools produce the same key from the same password?

Alice and Bob meet regularly. They have agreed face-to-face a 128 bit password which they want use to encrypt/decrypt emails written between them. They decide to use 256-bit AES. Alice wrote her ...
7
votes
1answer
3k views

Is the cipher "Kalyna" with a 512-bit key length more secure AES with a 256-bit key?

Recently I have found out that Ukraine has its own symmetric encryption algorithm "Kalyna". Developers of this algorithm said that their algorithm is more secure than AES because of longer key length ...
7
votes
3answers
6k views

Is it true that Serpent and twofish are much stronger than AES?

I heard that Serpent and Twofish are much stronger than AES, but it was chosen because it is faster. If that's true, please tell me why it is stronger. Also: is it true that Twofish and serpent are ...
7
votes
3answers
702 views

Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?

In general, we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that ...
7
votes
3answers
968 views

Should I use “modes of operation” for a single block of data?

I am using AES to encrypt my data. I have only 128 bit block that I am encrypting using AES. I am using AES in CTR (counter) mode, since it is always to advisable to use block ciphers along with modes ...
7
votes
3answers
3k views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
7
votes
1answer
6k views

How can there be AES-256-GCM, when GCM is defined for 128-sized blocks?

In both node.js and OpenSSL, I am seeing cipher "aes-256-gcm". However, in NIST Special Publication 800-38D, that defines GCM, I am reading: The underlying block cipher shall be approved, the ...
7
votes
3answers
2k views

How to protect key in software

I need to encrypt/decrypt data from my software by AES, the problem is how to make the AES key secure, there is no HSM, should I hard code the key in my code? It seems that a hacker can read the key ...
7
votes
2answers
5k views

Is AES really used for Top Secret stuff?

I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?
7
votes
3answers
4k views

Can I hash a secret key and used the hash as key ID?

I am using AES-CBC to provide confidentiality for protocol messages. I want to allow the receiver to know the secret key by using a key ID. For this I hash the secret key to generate a key ID. Every ...
7
votes
4answers
28k views

Can I find the encryption key if I know the plain text and the encrypted text (DES and AES)?

If I have the plain text and its output after encryption with a key K1, is it algorithmically feasible to find K1? I am specifically interested in the cases of DES and AES encryption algorithms.
7
votes
2answers
3k views

Why does AES-GCM not require an auth key, but encrypt-then-mac does?

The inputs to AES GCM mode appear to be: an IV a key message to encrypt The output is a cipher and auth tag. However, if one were to manually perform an encrypt-then-mac scheme, the inputs required ...
7
votes
2answers
2k views

Is it secure to derive an AES key from a MAC?

I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure (we have a “Hardware Security Module” ...
7
votes
2answers
9k views

Hybrid encryption with RSA and AES versus spliting into multiple RSA messages?

I've done research about this subject, but I can't find the answer I'm looking for. The problem is that the string I want to send doesn't fit into the RSA key that the client have, and during ...
7
votes
2answers
10k views

Rijndael vs. Serpent vs. Twofish: General comparison

Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision? Or is there ...
7
votes
1answer
943 views

Does AES encryption work like a padlock or like a safe?

If I encrypt a plaintext p using AES-256 in GCM mode with the keys $k_1 ... k_n$ and I want to decrypt it later, can I use the keys in any order when decrypting or do I have to use the same order as ...
7
votes
2answers
1k views

What is the importance of Rcon in Rjindael's key expansion from a security prespective?

I do not see why the Rcon function is important, it looks like a waste of cycles. $$\operatorname{Rcon}(i) = 2^{i-1} \bmod p(x)$$ is in $\operatorname{GF}(2^8)$, ...
7
votes
2answers
3k views

How do we prove that AES, DES etc. are secure?

How do we prove that AES, DES etc. are secure? I've read about them and know the basics on how they work, but I still don't quite understand how we can be sure they are secure? What are the proofs?
7
votes
2answers
1k views

AES Decryption followed by Encryption, will it produce the original text?

If a plain text is first decrypted (with the AES decryption algorithm) using Key K1 and then encrypted using same K1, would the final result still be the original plain text?
7
votes
1answer
3k views

Relationship between AES GCM and AES CTR

I have read that AES GCM uses AES CTR for encryption and GMAC for authentication. If that is correct, what is the relationship between the IV used for AES GCM and the IV used for AES CTR? TO put the ...
7
votes
1answer
2k views

Is it necessary for the Rijndael polynomial to be primitive?

I am working on selecting a S-box for my Cipher (Similar to AES). I found out there are 30 irreducible polynomials and over 16 primitive polynomials of degree 8. Is it necessary to choose a primitive ...
7
votes
1answer
3k views

What is considered a "weak key" in AES?

I need to construct an AES key from an array of bytes (in Java), but I first I have to check if the key created from these bytes would be weak. Java can check for weakness for DES, but not for AES. ...
7
votes
5answers
6k views

AES decryption vs encryption speed

Let's consider the CTR mode. For a faster encryption/decryption, is it preferable to use the decryption operation of AES, or its encryption ?

1
3 4
5
6 7
46