Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
2
votes
1answer
63 views

Does adding more XOR layers in the XEX block cipher mode increase its security or double it?

I read about XEX mode of operation in Wikipedia My question is: There are two keys that are XORed against plaintext, if instead of two XORed keys I add 4 or 6, does it increase the security of block ...
1
vote
1answer
102 views

Which block cipher modes are best used in real life situations?

For an exam I'm studying for, I'm wondering what block cipher modes are best to use in certain situations. We learned about these block cipher modes: ECB, CBC, CFB (+ s-bit), OFB (+ s-bit) and CTR. ...
0
votes
0answers
34 views

Objective block cipher round function measures of security

One issue that may arise when attempting to evaluate the security of a round function for a block cipher is that the analysis of the round function does not treat the round key space and the message ...
0
votes
1answer
58 views

Substitution-Permutation Network (SPN) Example

I came in contact with an algorithm that deals with SPN in an example, first I'd like to give a definition of what it is: Let $l, m, $ and $N$ be positive integers, let $\pi_s: \{0,1\}^l \to \{0,1\}^...
0
votes
0answers
14 views

Block Ciphers using Matrix Representation of quasigroups

This paper says that, each quasigroup of order 4 can be represented in matrix form using the following equation, \begin{equation} x \ast y \equiv m^T +Ax^T +By^T +CA\cdot x^T \circ CB\cdot y^T \end{...
0
votes
1answer
50 views

CTR and OFB block cipher modes and their post-quantum security. Some questions [duplicate]

It's said that quantum computers can break block ciphers with 2^(n/2) queries (being n the key size). I read this paper: https://eprint.iacr.org/2016/197 It says that CTR and OFB modes are safe ...
1
vote
2answers
976 views

How insecure would a cipher based on iterative hashing be?

I was just wondering how the following construction could be insecure. I can tell that known-plain attacks are possible, but I'm not sure about anything else. Let the user pick a password and hash it ...
0
votes
0answers
78 views

What are the vulnerabilities in this algorithm?

Bob and Alice sets common keys for a and b variables. All variables are equal length. Every message x and y variables are randomly changes ...
1
vote
0answers
29 views

Indistinguishability versus Indifferentiability

What is the Indifferentiability of Feistel Network? Why is the concept of Indifferentiability useful and how it is applicable in the real world? How is Indifferentiability compared to ...
1
vote
2answers
106 views

Is there any fundamental difference between the block cipher operations encryption and decryption?

Is there any fundamental reason to designate one direction of a block cipher as "encryption" and the other "decryption"? Or are these arbitrary choices? Or perhaps practical ...
9
votes
3answers
998 views

Any advantage to a block cipher which is not efficiently invertible?

The classic definition of a PRP includes efficient invertibility. Given that many modern cipher modes (CTR-based e.g. GCM) use only the forward direction of the block cipher, it seems that the ...
1
vote
0answers
42 views

Why can't we have AES512 or more? [duplicate]

Look I know AES256 is ridiculously secure but to keep aes secure even after quantum computers, I have a concern. Using the Grovers theorem aes can be reduced from 256 to 128 bits for brute force ...
0
votes
0answers
16 views

Use HMAC for every block encryption operation [duplicate]

Is it possible to use HMAC while performing encryption of blocks? I think that the main problem with the approach would be to get the same output size as the block, from the HMAC function. Also, the ...
0
votes
1answer
75 views

What is the need of substitution and permutation networks in AES?

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me. Consider an alternate construction for a block cipher without any substitution and ...
2
votes
0answers
57 views

What would be an O(n) time adversary for this kind of scheme

Suppose we have a block cipher $$E:\{0,1\}^k \text{ x } \{0,1\}^{2k} \rightarrow \{0,1\}^{2n} \quad \text{ with } \quad k,n\geq128$$ K is the key generation algorithm that returns a random k-bit key. ...
1
vote
2answers
66 views

How do we find differentials in differential cryptanalysis when we don't the details about the S-boxes

I m new to cryptanalysis and trying to understand differential cryptanalysis. I have read the paper by Howard M. Heys. I understood the concept of differentials but I m not able to understand how to ...
2
votes
1answer
46 views

Threshold implementation of ciphers

What is the principle behind threshold implementation of block ciphers and how is this protecting against side channel attacks?
2
votes
1answer
97 views

ECB... lacks diffusion(?)

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption. ...
0
votes
0answers
100 views

Why is a two-round Feistel Network not a PRF? [duplicate]

I am a student studying PRP and PRF in school, my prof gave us a thinking question: "Why is a two-round Feistel network not a PRF, even while the component function is a PRF?" I've seen that ...
2
votes
2answers
825 views

Which block cipher mode of operation does TLS 1.3 use?

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).
0
votes
0answers
24 views

Besides block-cipher which other methods can only be computed step-by-step even with known secret (but fast per step) and can be inverted?

Depending at the cryptographic function used applying it $i$-times to a given input can be computed in different complexity classes (based at their input size). $$f^i(m_0) = c_i$$ For example for most ...
4
votes
1answer
133 views

Lack of response to CAESAR competition

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
0
votes
0answers
49 views

How can a concatenation of $N$ block-cipher with known keys be more secure?

General problem / Intro: encrypting the (computable) relation in between two random numbers which are members of a as small as possible set while anything except the order of execution is known to the ...
0
votes
0answers
55 views

RSA implementation not working with large values for plaintext [duplicate]

While implementing RSA encryption/decryption (using python), the plaintext doesn't match with the decrypted ciphertext for large values of plaintext. Works fine for smaller values for plaintext (...
1
vote
1answer
81 views

Can a block-cipher considered secure if a bit-change of the input leads to a 50% chance change for every single output bit? -> round number?

Block-cipher use self-inverse ($f(f(x)) = x $) operations which then will be applied to the plaintext and most likely contain some constants which can be based at a key. To get security such ...
0
votes
1answer
32 views

Calculate number of active S-boxes for a cipher where one word observes multiple times overlapped S-box substitution in a single encryption round

There are many ways in which the number of active sboxes of a cipher for one round can be calculated. Like, a manual approach (all possible input differential are applied in the two plaintexts $P_0, ...
2
votes
1answer
115 views

Why key reuse is not an issue in a Feistel cipher?

I have a good understanding of stream ciphers and one time pad. I also know the dangers of using the same key in a PRG for a stream cipher. However as far as I can tell, the Feistel block cipher uses ...
1
vote
2answers
52 views

Integrity while using CBC

We have a body we want to encrypt using CBC, and we add to that body one block of known text to both sides. newBody = body + knownBlock now we encrypt newBody using a key known to both sides, then we ...
2
votes
3answers
83 views

Have the automorphism groups of block ciphers like the different version of the AES or DES been calculated?

Suppose that $F:K\times X\rightarrow X$ is a function. If $k\in K$, then let $F_{k}:X\rightarrow X$ be the mapping defined by letting $F_{k}(x)=F(k,x)$ for each $x\in X$. Then we shall call $F$ a ...
1
vote
1answer
76 views

"Fixing" PCBC mode?

In PCBC mode, one encrypts and decrypts via $$ C_i = E(P_i \oplus P_{i-1} \oplus C_{i-1}) \Longleftrightarrow P_i = D(C_i) \oplus P_{i-1} \oplus C_{i-1} $$ (where $P_0 \oplus C_0 = IV$), which has ...
1
vote
1answer
36 views

Rivest Cipher 6 (RC6) Key Scheduler

I am trying to understand the Key Scheduler used in RC6 and I have a total of 3 questions. The RC6 Wikipedia page says that the only difference between the RC5 and RC6 key scheduler is that more words ...
1
vote
1answer
48 views

Are there on-line ways to use a block cipher to generate unique $n$ bits that guarantee collision-freeness for $2^n$ times?

$n$ is a run-time variable chosen each time the user runs the implementation. One way I can think is to use any block cipher, say AES, as a seeded CSPRNG to randomly shuffle list of numbers $0, 1, \...
1
vote
1answer
82 views

Does keeping the IV secret in OFB mode makes brute-force more complex?

If we keep the IV secret, does that increase the complexity of finding the correct key? My first thought is that it increases complexity, but in real world, I can see that IV's aren't kept secret. We ...
0
votes
0answers
36 views

key recovery attack vs key extraction attack

I want to know what is the difference between the Key Recovery Attack and the Key Extraction Attack, especially in WhiteBox Cryptography? I guess key recovery is for the BlackBox and key extraction is ...
0
votes
1answer
59 views

does OFB mode has diffusion on the plaintext?

In some block modes, if we change one bit (or more) in the plaintext, the whole block\ciphertext will be changed (i.e ecb: block will be different. cbc: whole ciphertext will be different) Does ...
1
vote
2answers
49 views

RC6 Integer operations in modulo 32 between two 32-bit blocks

I am new to cryptography and I am trying to code the RC6 (Rivest cipher 6) algorithm. The algorithm requires addition, subtraction and multiplication in modulo 232. If I am performing these operations ...
0
votes
0answers
70 views

Any number-to-number cipher?

I am curious (not technically informed) if the number-to-number cipher is common/useful in cryptography. Imagine, we want to cipher integer y to integer ...
0
votes
1answer
125 views

What is the easiest encryption/cipher to brute force?

This is just a casual exploration of what could be effectively the worst possible block cipher, but I think it has some educational value on how ciphers work. I've been reading about unicity distance ...
0
votes
0answers
103 views

Designing your own Algorithm

I have been told to design my own algorithm as a college assignment. What I could have come up with was a random cipher. For example: Suppose my plaintext is: AND ...
0
votes
0answers
104 views

Prove that ECB-mode of a block cipher is not EAV-secure

I know that ECB-mode of block cipher is not recommended to use as it is not secure and is not even EAV-secure. However, I still don't get how to prove that it is not EAV-secure and what adversary is ...
1
vote
0answers
51 views

Are blockciphers with 64-bit blocks still relevant (in any scenario)?

Facts Blockciphers are used to build encryption algorithms and compression functions for hash algorithms. (Unkeyed) Permutations are also complementing blockciphers in encryption and hashing. Large ...
0
votes
0answers
52 views

Are there any block ciphers (like AES) which are (or can be) commutative under composition for different keys?

Let $BC$ be a block cipher with similar security as AES (in ECB mode). This $BC$ is applied to a message $m$ of same bit size. The result is a cipher $c$. e.g.; $$BC(key_A,m) = c_A$$ $$BC(key_B,m) = ...
1
vote
0answers
33 views

Where exactly do you add the zeroes to a URL in a padding oracle attack? Also, how would you decrypt a file this way?

I have been studying various crypto attacks, and one of the attacks that I have recently studied was the padding oracle attack. Now, I mostly understand it, but there is one aspect of the padding ...
1
vote
1answer
40 views

Construction of key recovery attack in O(2^(n/2))

I have to construct a key recovery attack on symmetric key encryption using a publicly known permutation $\Pi$ in $O(2^\frac{n}{2})$ time using $2^\frac{n}{2}$ queries to an encryption oracle. The ...
0
votes
0answers
64 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
1
vote
1answer
37 views

How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?

I have a device that needs to communicate with another host and exchange fixed-length messages. All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
4
votes
1answer
455 views

Why are block ciphers mostly used as stream ciphers?

Using a block cipher with using either CTR or GCM mode gives us a stream cipher, the only difference being that CTR does not include a MAC tag or AAD but GCM does. I think these are the most commonly ...
2
votes
1answer
181 views

Is there block cipher that is secure for n rounds but not secure when the rounds are increased?

The common wisdom is that increasing the number of rounds of a block cipher can make it more secure. This is quite true if we consider the linear and differential attacks. The Tiny encryption ...
1
vote
1answer
54 views

Do groups generated by round functions generate the alternating group?

Let $K,X$ be sets and let $F:K\times X\rightarrow X$ be a function. For each $k\in K$, let $f_{k}:X\rightarrow X$ be the function where $f_{k}(x)=F(k,x)$ whenever $k\in K,x\in X$. Assume that each $f_{...
1
vote
2answers
767 views

So is AES-256 more secure or less secure than AES-128 after all?

It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...

1
2 3 4 5
20