Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

key recovery attack vs key extraction attack

I want to know what is the difference between the Key Recovery Attack and the Key Extraction Attack, especially in WhiteBox Cryptography? I guess key recovery is for the BlackBox and key extraction is ...
0
votes
1answer
26 views

does OFB mode has diffusion on the plaintext?

In some block modes, if we change one bit (or more) in the plaintext, the whole block\ciphertext will be changed (i.e ecb: block will be different. cbc: whole ciphertext will be different) Does ...
1
vote
2answers
39 views

RC6 Integer operations in modulo 32 between two 32-bit blocks

I am new to cryptography and I am trying to code the RC6 (Rivest cipher 6) algorithm. The algorithm requires addition, subtraction and multiplication in modulo 232. If I am performing these operations ...
0
votes
0answers
48 views

Any number-to-number cipher?

I am curious (not technically informed) if the number-to-number cipher is common/useful in cryptography. Imagine, we want to cipher integer y to integer ...
0
votes
1answer
107 views

What is the easiest encryption/cipher to brute force?

This is just a casual exploration of what could be effectively the worst possible block cipher, but I think it has some educational value on how ciphers work. I've been reading about unicity distance ...
0
votes
0answers
98 views

Designing your own Algorithm

I have been told to design my own algorithm as a college assignment. What I could have come up with was a random cipher. For example: Suppose my plaintext is: AND ...
0
votes
0answers
56 views

Prove that ECB-mode of a block cipher is not EAV-secure

I know that ECB-mode of block cipher is not recommended to use as it is not secure and is not even EAV-secure. However, I still don't get how to prove that it is not EAV-secure and what adversary is ...
1
vote
0answers
51 views

Are blockciphers with 64-bit blocks still relevant (in any scenario)?

Facts Blockciphers are used to build encryption algorithms and compression functions for hash algorithms. (Unkeyed) Permutations are also complementing blockciphers in encryption and hashing. Large ...
0
votes
0answers
42 views

Are there any block ciphers (like AES) which are (or can be) commutative under composition for different keys?

Let $BC$ be a block cipher with similar security as AES (in ECB mode). This $BC$ is applied to a message $m$ of same bit size. The result is a cipher $c$. e.g.; $$BC(key_A,m) = c_A$$ $$BC(key_B,m) = ...
1
vote
0answers
25 views

Where exactly do you add the zeroes to a URL in a padding oracle attack? Also, how would you decrypt a file this way?

I have been studying various crypto attacks, and one of the attacks that I have recently studied was the padding oracle attack. Now, I mostly understand it, but there is one aspect of the padding ...
1
vote
1answer
36 views

Construction of key recovery attack in O(2^(n/2))

I have to construct a key recovery attack on symmetric key encryption using a publicly known permutation $\Pi$ in $O(2^\frac{n}{2})$ time using $2^\frac{n}{2}$ queries to an encryption oracle. The ...
0
votes
0answers
63 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
1
vote
1answer
34 views

How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?

I have a device that needs to communicate with another host and exchange fixed-length messages. All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
4
votes
1answer
376 views

Why are block ciphers mostly used as stream ciphers?

Using a block cipher with using either CTR or GCM mode gives us a stream cipher, the only difference being that CTR does not include a MAC tag or AAD but GCM does. I think these are the most commonly ...
1
vote
1answer
63 views

Is there a round block cipher that is secure for n round but not secure when the rounds increased

The common knowledge is that increasing the round of a block cipher can make it more secure. This is quite true if we consider the linear and differential attacks. The Tiny encryption algorithm is ...
1
vote
1answer
48 views

Do groups generated by round functions generate the alternating group?

Let $K,X$ be sets and let $F:K\times X\rightarrow X$ be a function. For each $k\in K$, let $f_{k}:X\rightarrow X$ be the function where $f_{k}(x)=F(k,x)$ whenever $k\in K,x\in X$. Assume that each $f_{...
1
vote
2answers
412 views

So is AES-256 more secure or less secure than AES-128 after all?

It seems there are attacks that work more effectively on AES-256 than AES-128, which makes it less secure in some cases. But the bigger key size should add some safety margin on the other hand, for ...
0
votes
0answers
35 views

Proper implementation AES-256 for single block E_k then being used on AES-GCM

My first objective is to implement AES-GCM in PowerShell 5.1 since there is not an implementation that not use external dll libraries. According to the GCM schema of encryption: the E_k block should ...
1
vote
1answer
281 views

Online AES Calculator

I am currently looking into how AES works and found a calculator online: http://testprotect.com/appendix/AEScalc I understand that the AES process has 10 rounds of calculations. Does this mean that ...
1
vote
2answers
122 views

How to minimize AES output size?

I work on a project about CAN bus and I want to encrypt the data among nodes but I have have a problem because CAN bus nodes receive and send 8 bytes among each others and I know the size of AES ...
1
vote
1answer
89 views

Why is this DES key considered weak?

I understand the premise of weak keys in DES and cryptography. From searching online, I understand that keys that are comprised of all zeroes / all ones / alternating ones and zeroes / alternating ...
1
vote
0answers
16 views

Is it possible to crack AES-256 ECB when provided with the ciphertext and a portion of the corresponding plaintext? [duplicate]

AES-ECB encrypts the message by breaking it into blocks and encrypting them one by one. Provided the knowledge of the ciphertext, a portion of the plaintext that corresponds to a block in the message, ...
2
votes
0answers
26 views

Does anybody have test vectors for the LBlock block cipher?

LBlock is a lightweight block cipher with 64-80 bits block-key size, designed by a group of Chinese scholars. Does anybody have LBlock test vectors? I am looking for test vectors, which contain the ...
2
votes
1answer
78 views

Complexity of Boomerang Attack on COCONUT98

I am trying to understand the paper The Boomerang Attack from David Wagner. On page 162 about complexity of boomerang attack the paper says that: The attack requires $8 \cdot 2 \cdot 32 \cdot 2^{32} ...
0
votes
0answers
19 views

Want to implement a cipher efficiently on Hardware with verilog, is there any standard resources to start?

I want to implement a new block cipher on hardware. The cipher has a look-up table and the rounds are not self-similar. So, the code size, as well as the chip area, is expected to be larger. I just ...
2
votes
1answer
77 views

How to use sagemath to find nonlinear invariants of S-box?

I read a paper about a nonlinear invariant attack that is "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64" And I've found a website of sagemath : https://...
1
vote
0answers
89 views

Vulnerability in DES3 when key can be chosen

In the question there are two functions encrypt basically does IV ⨁ DES3(P⨁IV) and encrypt_flag just encrypts the flag after being padded into a multiple of 8. IV is a random 8 byte number which is ...
0
votes
1answer
45 views

Does XORing a random block into a layer of CBC encrypted message add some bit strenght?

Let's suppose I encrypt a message with a block cipher in CBC mode, keep the key and IV secret and XOR a random block of data in each encrypted CBC block, being the XORed block the same for each CBC ...
0
votes
0answers
27 views

How do I preform the inverse key expansion of aes decryption? [duplicate]

I’m working on an aes encryption and decryption project in 8086 assembly! I managed to code an encryption algorithm and it worked perfectly. No I’m working on the decryption algorithm. I’ve managed to ...
1
vote
1answer
35 views

Quadratic Equations to Describe SBox

I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
0
votes
1answer
86 views

Security Analysis

I have designed my own lightweight cryptographic algorithm and now measuring its security. I was finding bounds on probabilities against linear and differential attacks. For differential ...
1
vote
1answer
39 views

How to prove the pseudorandomness of CryptoPAn

in my cryptography course, we are learning about pseudo randomness and the prefix-preserving function known as CryptoPAn invented in 2002. It is said that the scheme is highly insecure. So in that ...
0
votes
0answers
49 views

Random Oracle Model for an ideal block cipher vs Ideal Cipher Model

Some security proof involving an ideal function use the Random Oracle Model (ROM). They posit a thing that given integer $b$ and bistring $M$, returns what it previously returned for that input $(b,M)$...
1
vote
1answer
63 views

how can identify which cryptanalysis is used ( Indistinguishability cryptanalysis against classical ciphers) [duplicate]

I have 10 ciphertexts and 10 plain texts I want to know which cipher is from which plain text how can I know this I know the name of substitution cipher, transposition cipher, Vigen`ere cipher and ...
0
votes
0answers
50 views

Number of false keys in exhaustive key search for block ciphers

I'm doing a self study through Understanding Cryptography by Christof Paar and I have a question about Theorem 5.2.1 in the book: Given a block cipher with a key length of $k$ bits and block size of $...
0
votes
2answers
121 views

AES plaintext is smaller than 128 bits [duplicate]

I'm currently developing a AES implementation in a graduation project at university. As far as I know, AES uses a 128 bit block length as input . if the entered string to encrypt is not 128 bits such ...
1
vote
1answer
538 views

How does using a really small block size reduce the key space?

I read this online and was confused: Modern block ciphers tend to have block sizes of 128 bits or larger, because if the block size is too small there is the same problem as a small key space as ...
3
votes
1answer
72 views

Number of plaintext–ciphertext pairs needed to rule out false keys with a reasonable likelihood in AES

I am new to cryptography and I've got the following question from Understanding Cryptography: Imagine that aliens — rather than abducting earthlings and performing strange experiments on them — drop a ...
1
vote
1answer
57 views

1:1 algorithmic shuffle of massive numerical space

For a personal project I'm currently tinkering on, I'm looking for a function which has the following properties: For any number X in the range 0..MAX, there is a 1:1 random mapping with another ...
1
vote
0answers
59 views

Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)

I want to prove the security of a Tweakable Block Cipher in CBC Mode How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
2
votes
0answers
40 views

LibTomCrypt Documentation on LRW Mode/Tweakable Block Cipher - Apparent Contradiction?

In the LRW mode discussion on page 34/161 of the LibTomCrypt manual, available here for example https://opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/Source/libtomcrypt/doc/...
1
vote
1answer
69 views

Listing first 8 bits generated by LFSR

Consider the primitive polynomial P(x) = x^4 + x^3 + 1, initialized with the bit string (shifting occurs from left to right, were the right-most bit represents the LFSR output): 1101. List the first 8-...
0
votes
1answer
50 views

IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days. Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a ...
0
votes
1answer
72 views

Finding Multiplicative Inverse In Field

Consider the finite set Z_257 of non-negative integers less than 257. The number 257 is a prime, so Z_257 forms a field with addition and multiplication mod 257. How can I use the Extended Euclidean ...
0
votes
0answers
119 views

OpenSSL DES encryption for KCV calculation

I'm trying to implement a simple command-line tool to calculate the (Key Check Value) KCV of some encryption keys. The algorithm for the KCV is simply to encrypt a block of 8 zeros with DES and get ...
2
votes
2answers
91 views

Question on the CPA-security proof of the CTR-Mode

While reading Katz & Lindell's textbook (2nd edition) I found a proof for the CPA-Security of CTR-Mode. It can be found at the end of chapter 3.6.2 (page 93 and 94). I don't quite understand, why ...
3
votes
1answer
76 views

Backdoor Designer Key Recovery in LowMC-M

The paper https://eprint.iacr.org/2020/986.pdf proposed a framework for embedding a malicious backdoor in LowMC cipher, that will later help the designer to recover the secret key in the known-...
2
votes
0answers
60 views

Is there any way to encrypt the path in between a small number of 3D positions?

Or more general: given two valid random cipher $c_0, c_1$ a function $D$ with $$D(c_0,c_1) = (a,b,c)$$ should exist but hard to compute (for most cases). The result $(a,b,c)$ represents the path from $...
1
vote
2answers
108 views

Hashes as mutually independent keys

For cascading encryption (ie. AES-Twofish-Serpent), the most secure implementation is with mutually independent keys. My question is if it is secure to hash the previous key for each layer of ...
1
vote
1answer
85 views

Is AES strictly speaking a SP network?

Forgive me if this seems like a trivial question. I've read that AES is a SP network. However, when reading about P-boxes in SPNs they say that they simply shuffle bits around. In AES the ShiftRows ...

1
2 3 4 5
19