Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Which among the following is a method of encryption where units of plain text are replaced with cipher text according to a fixed system? [closed]

Substitution Cipher DES AES All of the above Basically, I am confused between all three. Because all of them are symmetric. Yet, AES and DES are block ciphers. Any idea?
user avatar
11 votes
1 answer
2k views

Why expand keys? Why not rather generate a longer key?

AES-128 takes a 128-bit key (four 32-bit words), and expands it to a 352-bit key schedule (11 words). Speck48/72 takes a 72-bit key (three 24-bit words), and expands it to a 528-bit key schedule (22 ...
user avatar
1 vote
0 answers
40 views

How one can combine shift row and mix column to form a single matrix?

I am trying to combine the effect the shift row and mix column into a single matrix. The cipher that I am working with is skinny64 (untweaked version). I know that combining the effect of these two ...
user avatar
0 votes
2 answers
71 views

Are Block Ciphers Pseudorandom functions? [duplicate]

I am reading this page on wikipedia on Key derivation function here where it states: In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys ...
user avatar
1 vote
1 answer
60 views

Private key encryption based on NP-complete problem

Over a decade ago, a question was asked on Stack Overflow, which basically asked if there were any encryption schemes that are reducible to an NP-complete problem, in the sense that breaking the ...
user avatar
  • 480
0 votes
0 answers
37 views

Can we combine two AES (with block size 128) to to a block cipher with a block size 192 which is collision-resistant?

Encrypting values with AES we only need about $2^{64}$ trials until we finding an already used value (some collision). This can be done these days with easy. To make this harder can we combine two AES ...
user avatar
  • 475
1 vote
1 answer
58 views

What is the security of multiple encryption using Even–Mansour scheme (XEX)?

As I know, the best attack on single or double Even-Mansour scheme is N/2, being N the key size (or size of one of the two keys used). I know that encrypting two times using this scheme is susceptible ...
user avatar
0 votes
0 answers
26 views

Is there a common method for a virtual two way dictionary of statistically independent random values with a domain size of about 192bit? (like ECB BC)

Is there any commonly used dictionary/codebook like function $D$ which assigns for every value $r_i \in V=[0,s-1]$ with $s\approx 2^{200}$ a value $r_j$ also $\in V$ $$D(r_i) = r_j$$ and is self-...
user avatar
  • 475
0 votes
0 answers
33 views

An adversary does know the block cipher key and some bits of the message and the cipher (same length as key). Does this help him to find pairs? (ECB)

Given a $N$-bit AES or similar block cipher with his $N$-bit key $k$. We can encrypt a $N$-bit message $m$ to a $N$-bit cipher $c$ and decrypt it again. $$E(m,k) = c$$ $$D(c,k) = m$$ An adversary does ...
user avatar
  • 475
0 votes
1 answer
59 views

Why is using a truly random function in a fixed length encryption scheme not efficient?

I am working through Katz and Lindell, and Theorem 3.26 in the book proves that a construction based on a PRF is CPA-secure. The thrust of the scheme is that if $F_k$ is a PRF, with $k, m, r \in \{0, ...
user avatar
  • 480
0 votes
1 answer
54 views

How round constants are chosen in a block cipher?

Block ciphers that are NOT LIGHTWEIGHT use relatively complex key scheduling algorithms to enhance their security and thwart some of the known cryptographic attacks. In such ciphers round constants ...
user avatar
0 votes
0 answers
25 views

How many number of sequences (sample size) should be selected for randomness testing of bock cipher with 256 bits key and block length?

I am working on randomness testing of block cipher. I have gone through the NIST two papers of randomness testing of AES candidate algorithm, links are given below https://csrc.nist.gov/csrc/media/...
user avatar
0 votes
1 answer
63 views

Why is ShiftRow important in AES?

I came across a comment about AES 128 without ShiftRow. I want to use this weakness to perform an attack. So far, I get that It possible to divide in 4 independent blocks of 32 bits. So we can launch ...
user avatar
2 votes
1 answer
455 views

Why not use a random permutation as a block cipher?

The purpose of a block cipher is to act like a random permutation, and indeed a common security definition is one in which the block cipher is taken to be indistinguishable from a random permutation (...
user avatar
  • 480
1 vote
1 answer
75 views

How to crack sha256 used as streamcipher with known or guessable block

Using SHA-256 as a stream cipher appears to bear cryptographic weaknesses, however, I am not quite sure how to implement them in decryption. Assume that I have an encryption function using 64-byte ...
user avatar
2 votes
2 answers
93 views

What is the difference between AES-CCM8 mode and AES-CCM mode?

I know AES-GCM and AES-CCM but what is the difference between AES-CCM8 mode and AES-CCM mode ? Is it the length of the cipher?
user avatar
  • 19
1 vote
1 answer
50 views

How do different types of ciphers relate to each other?

I understand that there are symmetric and asymmetric (public-key) cyphers. The first have the same key used for encryption and decryption, while the second use a public key for encryption and a ...
user avatar
  • 111
0 votes
0 answers
42 views

Post-quantum security of multiple-encryption with CTR mode of operation while keeping the IVs secret

I received an answer in one of my questions saying that multiple-encryption with CTR mode of operation is vulnerable to a sort of meet-in-the-middle attack if the IVs are public. The same user said ...
user avatar
0 votes
0 answers
42 views

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
user avatar
  • 19
1 vote
0 answers
38 views

What would be the consequences of using a IV smaller than the block size in CBC encryption?

Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
user avatar
1 vote
0 answers
34 views

CBC MAC forgery

$\text{CBC-MAC}$ is defined as follows: $\text{CBC-MAC}_k() = IV $ $\text{CBC-MAC}_k(m_1, . . . , m_n) = E_k(m_n \oplus \text{CBC-MAC}_k(m_1, . . . , m_{n−1}))$ My lecture notes say that this is ...
user avatar
3 votes
0 answers
70 views

In Feistel block ciphers, does using a weak but iterated encryption function result in a cryptographically strong cipher? [duplicate]

There is a Feistel block cipher based on Blowfish called Kaweichel. In one of its papers, there is this affirmation: For the construction of the round function one choses usually parallel ...
user avatar
1 vote
0 answers
93 views

Show that block cipher with CTR is a good PRNG

Assume that block cipher scheme $(KeyGen, Enc, Dec)$ is CPA-secure. Show that $CTR_{Enc_k(0^n)}$ is a good PRNG. Counter mode works as follows: $Y_i = Enc_k(IV + f(i))$ $C_i = Y_i \bigoplus P_i = Y_i \...
user avatar
  • 123
1 vote
1 answer
96 views

What kind of assumptions usually go into the design of block ciphers?

What are some standard assumptions made in showing the security of a block cipher? For example, is it commonly assumed that $P\not=NP$? To this end, are there any block ciphers whose security does ...
user avatar
  • 480
1 vote
1 answer
45 views

Does inserting an entry of 32/64-bits into a Feistel S-box would consume the same cycles per byte as inserting a single byte?

Blowfish splits a 32-bit word into 4 bytes and insert each byte as an entry in a S-box. Let's suppose I do the same but with an entire word, 32 or 64-bits. MARS block cipher does the same with 32-bit ...
user avatar
0 votes
0 answers
46 views

Security of Blowfish with secret S-boxes

There are similar questions about secret S-box(es), but none of them about secret Blowfish (or any other canonical Feistel cipher) S-Boxes, only about secret AES S-Box. Let's suppose that instead of ...
user avatar
1 vote
1 answer
43 views

16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?

I learned that in Substitution–permutation block ciphers, the maximum size of S-Box set to receive an entry from a data is the max numeric count of the data, for example, if the entry is 8-bits the S-...
user avatar
1 vote
1 answer
124 views

Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?

Blowfish splits a 32-bit word into 4 sets of 8-bits (1 byte) and use them as entries in its S-Boxes. Kuznyechick splits two 64-bits words in many nibbles (4-bits chunks), use them as entries in its S-...
user avatar
0 votes
0 answers
16 views

In SPN block cipher, is each bit of the ciphertext dependent on each bit of the S-boxes set?

In substitution–permutation network block ciphers like AES, when encrypting a plaintext into a ciphertext, will each bit of the ciphertext be associated to each bit of the S-boxes set in the cipher? I ...
user avatar
1 vote
0 answers
45 views

Encrypting with one key and decrypting with a related key

Given $n$-bit block cipher $E$ (and its inverse $E^{-1}$), define block cipher $E^\prime_k(m) = E_k(E_{f(k)}^{-1}(m))$ where $k,f(k) \in \{0,1\}^n$ and $\forall k:f(k) \ne k$. Under the ideal block ...
user avatar
  • 13.3k
0 votes
1 answer
38 views

If keeping the S-Boxes secret in SPN ciphers increase they security, does using one different S-Box set per round in them increases even more? [duplicate]

I read in this paper that keeping the S-boxes secret in AES raise its security from 128-256-bits to 1812-1940-bits. Let's suppose I use one different S-Boxes set per single round. /\ Does this ...
user avatar
2 votes
1 answer
61 views

Can the security margin of any Feistel block cipher be multiplied if I just multipy the number of rounds and use different random subkeys each round?

Kaweichel is a port of Blowfish for 64-bit architectures, its key size accepted is 1920-bytes, instead of 16 rounds it has 32 rounds, the double of Blowfish. ICE is a feistel block cipher that has a ...
user avatar
0 votes
0 answers
18 views

Does the security margin of Kalyna block cipher double per for additional 4 rounds? Would be possible to create a version of it with larger key sizes?

I believe this question should be directed to the authors of Kalyna block cipher, but I think they cannot answer me because of the war they are facing in their country actually. I know that AES uses ...
user avatar
2 votes
1 answer
92 views

What would be the disadvantages of very large block sizes in block ciphers?

Let's suppose someone creates a block cipher with 8192-bytes of the block size (65536-bits) or maybe 16384-bytes of the block size (131072-bits). What would be its disadvantages over a block cipher ...
user avatar
1 vote
1 answer
30 views

OFB mode discussion

In OFB mode, I understand that a bit flip in $c_i$ for $i > 0$ only causes a bit flip in message block $m_i$. However, how is it possible for a bit flip in $c_0$ (i.e, in IV) will result in all the ...
user avatar
  • 15
0 votes
0 answers
33 views

Does random IVs in CTR block cipher mode combined with XOR allow to encrypt number of blocks up to the same numeric count of IV?

I read about CTR block cipher mode in Wikipedia: "If the IV/nonce is random, then they can be combined with the counter using any invertible operation (concatenation, addition, or XOR) to produce ...
user avatar
0 votes
1 answer
42 views

If converting a SPN Block Cipher to a version with larger block size, should its S-boxes be enlarged too?

Let's suppose I want to convert a Substitution-permutation network block cipher like Kuznyechik to a version with a larger block size. Should its S-boxes be enlarged too in order to achieve similar ...
user avatar
2 votes
2 answers
178 views

How to calculate/generate the inverse S-box of Kuznyechik block cipher?

Let's suppose I want to modify Kuznyechik block cipher by choosing a random S-box (taken from /dev/random for example). How can I calculate/generate the inverse S-box? Does anyone know the formula or ...
user avatar
4 votes
0 answers
85 views

Security analysis of North Korean block cipher Jipsam1

The cipher is a modification to AES and is described on this website: The only difference between Jipsam1 and AES-256 is the S-box. Whereas in AES the S-box is public and constant, namely $$ \begin{...
user avatar
  • 13.3k
0 votes
0 answers
23 views

How are keys shared safely for block / stream encryption?

I've picked up a grad level computer security class. I read a brief overview on block and stream encryption. I understand and have used PGP in the past and it make since to share your public key. ...
user avatar
  • 1
0 votes
0 answers
33 views

What is benefit of using substitution before permutation or permutation before substitution in a block cipher?

I am trying to understand the difference between the usage of permutation and substitution in a SP Network. Normally, in ciphers except DES, substitution appears to be done before permutation. But ...
user avatar
1 vote
0 answers
45 views

Is F' = G(F)) a secure PRF given F and G are secure? [closed]

If we have a secure PRF 𝐹(𝑘, 𝑥) and a PRG G where 𝐺 : 𝒴 → 𝒴 × 𝒴 is a secure PRG. Is the PRF F'(k, x) = = 𝐺(𝐹(𝑘, 𝑥)) also secure?
user avatar
  • 11
0 votes
1 answer
41 views

How to understand the "Authenticity" and "Privacy" of CCM-mode encryption scheme?

CCM mode refers to CTR+ CBC-MAC encryption mode. Based on this paper, the adversary's advantages against the authenticity of CCM is: Eq(1) Authenticity: it should be infeasible for an adversary to ...
user avatar
0 votes
0 answers
52 views

Is secure of RC6 cipher consider as weak secure? / how to increase safety in RC6 cipher?

I saw a paper said RC6 cipher is weak and weakness cause of using 'SINGLE CLASS OF WEAK KEYS' What is that mean? and could we solve this problem ? Thank you.
user avatar
2 votes
2 answers
98 views

Ideal cipher vs Ideal encryption scheme

Ideal cipher is a random permutation for every key in its key space. And, ideal encryption scheme is the one which has perfect secrecy/indistinguishability. For an encryption scheme, random ...
user avatar
0 votes
0 answers
57 views

Time and space complexity analyzation of meet and middle attack of triple DES

How can we analyze the time and space complexity of meet and middle attack on a Triple-DES?
user avatar
0 votes
0 answers
19 views

Encrypting a random block with XTS and XORing into the plaintext: Would this encipherment scheme be secure?

I had an idea to make XTS mode parallelizable at CPU level. Let's suppose I take two AES-256 keys for XTS and encrypt a 512-byte block with this block cipher mode and XOR the output into the plaintext....
user avatar
0 votes
0 answers
30 views

What percentage of the keyspace should be brute-forced to find an equivalent key if the block cipher has?

I have been reading the Hasty Pudding Cipher specification and the author make clear that the cipher has some equivalent keys if the keyspace is larger than 8192-bits: ...
user avatar
4 votes
1 answer
169 views

The different bounds of PRP/PRF switching lemma

The PRP/PRF switching lemma is usually denoted as follows: I understand the proof of this version of the bound $\frac{q(q-1)}{2^{n+1}}$ and the game-playing technique behind it. However, I came ...
user avatar
  • 115
0 votes
1 answer
53 views

How does dm-crypt in Linux make non-parallelizable encryption modes have all the 512-byte blocks different each other?

dm-crypt in Linux uses 512-byte blocks (disk sectors) having sub-blocks of encrypted plaintext for block cipher modes that are non-parallelizable: "With the usual modes in cryptsetup (CBC, ESSIV, ...
user avatar

1
2 3 4 5
21