Questions tagged [block-cipher]
A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.
1,132
questions
1
vote
0
answers
38
views
Algorithm to turn a blockcipher into a PRP for any (large) group size
Which algorithm is most efficient to turn a 128 bit block cipher and create a PRP for any group size, e.g. for values in a range $[0..n)$ where $n$ isn't necessarily a an exponent of two? I'm ...
- 93.9k
0
votes
1
answer
49
views
How to understand the counterexample constructed in the PRP/PRF switching lemma towards the standard proof?
I'm reading a paper Code-Based Game-Playing Proofs and the Security of Triple Encryption , which indicates an error on the standard proof of the PRP/PRF switching lemma using the conditional ...
- 3
4
votes
1
answer
166
views
Efficiently implementing Speck96
Are there any efficient implementations of Speck96? The problem is how to efficiently do 48-bit arithmetic on 64-bit words, the rotates in particular. I've been trying to implement it and have written ...
- 205
2
votes
1
answer
62
views
Attack on Even-Mansour on top of 10 rounds of AESENC
Consider a block cipher with 128-bit block and 128-bit key, built per the one-key Even-Mansour construction on top of a permutation consisting of 10 rounds of AESENC:
XOR the 16-byte input block with ...
- 144k
3
votes
2
answers
134
views
Would there be any advantage in combining Feistel network and substitution-permutation network in a single cipher?
One common way to design invertible block ciphers is using a Feistel network used in for example DES and Blowfish. Another common way is a substitution-permutation network used in for example Rijndael ...
- 1,613
3
votes
3
answers
146
views
Security of cascaded ciphers (including question on counter-example from a paper)
A recurring theme is the security benefits of cascading two or more different ciphers. The idea is to enhance security, especially if one of the ciphers is later compromised. Intuitively (see below), ...
- 629
3
votes
2
answers
134
views
What are advantages/disadvantages of an invertible tweak schedule in a tweakable block cipher?
I have been doing research on a tweakable block cipher called BipBip. This is a rather niche cipher so I'll give a few facts about it for background before asking my question:
The structure is based ...
- 31
0
votes
0
answers
60
views
Parallel block cipher in CTR mode and variable number of threads: how to deal with internal state and permit decryption?
I'm implementing a parallel block cipher (Morus, to be precise) in CTR mode and I'd like to make it flexible with respect to the number of threads. It is not difficult per se, as I can partition the ...
- 101
4
votes
1
answer
200
views
How to prove the conclusion " linear operation $\mathsf{XOR}$ does not affect the division property"?
Division property is proposed as a generalized integral property at Eurocrypt 2015 by Yosuke Todo in his paper Structural evaluation by generalized integral property, And in paper Integral ...
- 143
1
vote
1
answer
57
views
Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?
Let
$$M= \begin{bmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{bmatrix}$$
which is used in the block ciphers MIDORI and MANTIS. Of course this matrix ...
2
votes
1
answer
74
views
Which was the first cipher that used the Maximum distance separable (MDS) matrix?
MDS matrices are used in the diffusion layer of block ciphers. I am interested in knowing who was the first researcher(s) who used an MDS matrix in their cipher. Thanks in advance.
5
votes
1
answer
1k
views
Can unauthenticated encryption be broken if the encrypted data looks random?
If we have some random data (with length a multiple of block size to avoid padding) and encrypt it with a block cipher with a weak key (maybe it's derived from a four digit number for example), would ...
- 862
1
vote
0
answers
76
views
New Impossible Differential Attacks on AES reduce time complexity
I am interested in the following snippet from the paper New Impossible Differential Attacks on AES.
Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack
The most time consuming steps of ...
- 41
0
votes
1
answer
61
views
Does truncating a CBC ciphertext result in a truncated plaintext?
I want to know why in the CBC cipher, if we truncate the first block in the ciphertext then the corresponding plaintext block is truncated in the same way. I have an equation for the plaintext $m_i$ ...
- 75
2
votes
0
answers
30
views
Can a differential attack on FEAL4 yield multiple valid keys?
For my version of this attack I used the FEAL4 version depicted here http://theamazingking.com/crypto-feal.php and in the book "Applied Cryptanalysis Breaking Ciphers in the Real World -- Mark ...
2
votes
0
answers
53
views
Design criteria of block ciphers in quantum setting
Some design criteria of block ciphers are already known for the resistance against known attacks like differential, linear , boomerang, etc. Does there already exist any study of design criteria of ...
- 31
1
vote
1
answer
108
views
When using AES, is doing encryption followed by decryption with the same key efficient?
It seems that rekeying between block cipher calls of AES is expensive. Meaning that calling $AESenc(K_1,M_1)$ and then calling $AESenc(K_2,M_2)$ with $K_1 \ne K_2$ is slower than calling $AESenc(K_1,...
- 55
1
vote
1
answer
54
views
Differential uniformity of vectorial Boolean function
What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
- 31
1
vote
1
answer
212
views
Statistical differences between ciphertexts generated by AES in ECB vs CBC mode?
Given two ciphertexts encrypting the same (natural language) plaintext, where we know that one of the ciphertexts was encrypted with AES-CBC (and unknown IV) and one was encrypted with AES in EBC mode,...
- 113
0
votes
0
answers
20
views
Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models
In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered.
Typically, security proofs for cryptographic modes ...
- 1
3
votes
1
answer
303
views
Are block ciphers still relevant in 2024?
Is the general approach of block ciphers still relevant when we have secure and performant pure stream ciphers?
For example, TLS 1.3 supports both AES-GCM and chacha20-Poly1305. But I don't understand ...
- 129
0
votes
1
answer
80
views
Can I prove AES-GCM nonce reuse just from the bytes?
I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
- 1
0
votes
0
answers
30
views
In Vigenère, if I encrypt a plaintext with a block cipher before applying the key, will it be possible to recover the key if it repeats?
This question may seem related to this one, but it is not the same.
Let's suppose I take 1GiB of data, encrypt the data with a (secure) block cipher and apply the Vigenère key, being the key much ...
- 393
0
votes
0
answers
56
views
Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?
I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
5
votes
1
answer
287
views
New NIST Journey: Accordion Cipher Mode
NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
- 2,268
1
vote
1
answer
144
views
BLAKE3 for Block and Stream ciphers?
When assuming the following idea for ciphers:
For a block cipher, a 4-round balanced Feistel network where the PRF is BLAKE3 and the key schedule is: input key, input key with every odd bit flipped, ...
- 11
3
votes
2
answers
235
views
Shannon's Diffusion: classical ciphers vs modern ciphers
Is there an easy to understand and intuitive "one fits all" definition for the concept of diffusion that is applicable to both modern binary cryptosystems as well as classical ciphers?
For a ...
- 31
1
vote
1
answer
414
views
ChaCha20 as a block cipher
Would it be possible to use ChaCha20 as a block cipher? With the key, the entire block function can be reversed.
- 15
0
votes
1
answer
74
views
Can HKDF be safely used as a round function in a Feistel Cipher
Hello my question is it practical to use HKD as a round function in a Feistel Cipher
I know you should not roll your own crypto, this is for learning purpose's only.
Take a look at my code and let me ...
- 3
1
vote
0
answers
93
views
Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?
For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical.
So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x ...
1
vote
1
answer
85
views
Can ECB block cipher mode be used to implement CTR?
looking at the linux kernel provided cipher and block cipher modes cat /proc/crypto my prefered mode CTR (counter/integer) is ...
- 405
3
votes
2
answers
323
views
How to handle padding when encrypting a value smaller than the block size
I want to encrypt numeric identifiers into ciphertexts that are deterministic and not too long. I am considering AES-128 in ECB mode to encrypt 64-bit integers. How should I pad the 64-bit integers, ...
- 696
0
votes
0
answers
69
views
How to estimate the bias of linear cryptanalysis given the input and output masks
Assume the input linear mask is $a$, and output mask is $b$，for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is
\begin{equation*}
...
3
votes
1
answer
84
views
Midori block cipher design: importance of $S_b$ as the S-box
With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
- 31
-1
votes
1
answer
84
views
Is plaintext and ciphertext absolutely one-to-one in symmetric encryption algorithms? [closed]
Known conditions:
The block size of this algorithm is 16 bytes.
If there are multiple encryption modes, then it is limited to ECB mode.
Always use only one immutable key.
Since only ECB encryption ...
- 139
0
votes
0
answers
74
views
Differential cryptanalysis of modes of operation
It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
- 255
0
votes
0
answers
71
views
Achieving sub-block non-malleability
I have a noisy one-way communication channel where data is sent as a series of words of width n bits.
Assume n is a constant roughly in the range of 16...48.
I don't want bit errors in one word to ...
- 101
1
vote
1
answer
135
views
Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]
While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
- 21
2
votes
1
answer
122
views
Does combining a stream cipher and block cipher produce any vulnerabilities?
In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305.
The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
- 21
1
vote
0
answers
83
views
Can the requirement to increase rounds with key size be bypassed?
When taking AES for example, the number of rounds increases as the key size increases.
This is done in order to adequately diffuse key bits into the state of the cipher.
Suppose you replace the AES ...
- 222
0
votes
0
answers
45
views
What is the security of XTS block cipher mode of operation if the key is much larger than the block size?
I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits.
I ...
- 393
2
votes
1
answer
74
views
n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$
I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
- 63
0
votes
0
answers
65
views
AES-ECB attack encryption audio fie
I got two audio files one is encrypted and the other file is a part of the plaintext. I want to extract all the plaintext. I am using the AES-ECB mode, the size of the block is 128 bits and the start ...
0
votes
0
answers
111
views
What is the AEGIS design rationale for one way rounds and slow diffusion?
The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation.
As you can see the previous state is XORed with AES applied to itself ...
- 222
1
vote
1
answer
136
views
How secure is half-key Even-Mansour?
Single-key Even-Mansour is secure up to $2^{0.5 \times n}$. Where $n$ is permutation and key size.
Would using $n/2$-key retain same security as $n$-key?
Could the other half be used as a tweak?
- 1,682
0
votes
0
answers
83
views
Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?
Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode:
Full State Keyed Sponge (FKS) construction:
FKS has been ...
- 222
0
votes
0
answers
81
views
Having trouble providing a distinguisher proving this hash function is not collision-resistant
As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
- 19
3
votes
0
answers
101
views
A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3
The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
- 1,367
2
votes
1
answer
163
views
Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?
Use a block cipher in CBC mode with a public or all-0 key. Twice.
Wrapping the last block into (xor) the first on the second round.
Every block will depend on all previous and all successive blocks. ...
3
votes
1
answer
78
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31