# Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

1,132 questions
Filter by
Sorted by
Tagged with
1 vote
38 views

### Algorithm to turn a blockcipher into a PRP for any (large) group size

Which algorithm is most efficient to turn a 128 bit block cipher and create a PRP for any group size, e.g. for values in a range $[0..n)$ where $n$ isn't necessarily a an exponent of two? I'm ...
• 93.9k
49 views

### How to understand the counterexample constructed in the PRP/PRF switching lemma towards the standard proof?

I'm reading a paper Code-Based Game-Playing Proofs and the Security of Triple Encryption , which indicates an error on the standard proof of the PRP/PRF switching lemma using the conditional ...
166 views

### Efficiently implementing Speck96

Are there any efficient implementations of Speck96? The problem is how to efficiently do 48-bit arithmetic on 64-bit words, the rotates in particular. I've been trying to implement it and have written ...
• 205
62 views

### Attack on Even-Mansour on top of 10 rounds of AESENC

Consider a block cipher with 128-bit block and 128-bit key, built per the one-key Even-Mansour construction on top of a permutation consisting of 10 rounds of AESENC: XOR the 16-byte input block with ...
• 144k
134 views

### Would there be any advantage in combining Feistel network and substitution-permutation network in a single cipher?

One common way to design invertible block ciphers is using a Feistel network used in for example DES and Blowfish. Another common way is a substitution-permutation network used in for example Rijndael ...
• 1,613
146 views

### Security of cascaded ciphers (including question on counter-example from a paper)

A recurring theme is the security benefits of cascading two or more different ciphers. The idea is to enhance security, especially if one of the ciphers is later compromised. Intuitively (see below), ...
• 629
134 views

### What are advantages/disadvantages of an invertible tweak schedule in a tweakable block cipher?

I have been doing research on a tweakable block cipher called BipBip. This is a rather niche cipher so I'll give a few facts about it for background before asking my question: The structure is based ...
• 31
60 views

### Parallel block cipher in CTR mode and variable number of threads: how to deal with internal state and permit decryption?

I'm implementing a parallel block cipher (Morus, to be precise) in CTR mode and I'd like to make it flexible with respect to the number of threads. It is not difficult per se, as I can partition the ...
• 101
200 views

### How to prove the conclusion " linear operation $\mathsf{XOR}$ does not affect the division property"?

Division property is proposed as a generalized integral property at Eurocrypt 2015 by Yosuke Todo in his paper Structural evaluation by generalized integral property, And in paper Integral ...
• 143
1 vote
57 views

### Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?

Let $$M= \begin{bmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{bmatrix}$$ which is used in the block ciphers MIDORI and MANTIS. Of course this matrix ...
74 views

### Which was the first cipher that used the Maximum distance separable (MDS) matrix?

MDS matrices are used in the diffusion layer of block ciphers. I am interested in knowing who was the first researcher(s) who used an MDS matrix in their cipher. Thanks in advance.
1k views

### Can unauthenticated encryption be broken if the encrypted data looks random?

If we have some random data (with length a multiple of block size to avoid padding) and encrypt it with a block cipher with a weak key (maybe it's derived from a four digit number for example), would ...
• 862
1 vote
76 views

### New Impossible Differential Attacks on AES reduce time complexity

I am interested in the following snippet from the paper New Impossible Differential Attacks on AES. Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack The most time consuming steps of ...
61 views

### Does truncating a CBC ciphertext result in a truncated plaintext?

I want to know why in the CBC cipher, if we truncate the first block in the ciphertext then the corresponding plaintext block is truncated in the same way. I have an equation for the plaintext $m_i$ ...
• 75
30 views

### Can a differential attack on FEAL4 yield multiple valid keys?

For my version of this attack I used the FEAL4 version depicted here http://theamazingking.com/crypto-feal.php and in the book "Applied Cryptanalysis Breaking Ciphers in the Real World -- Mark ...
53 views

### Design criteria of block ciphers in quantum setting

Some design criteria of block ciphers are already known for the resistance against known attacks like differential, linear , boomerang, etc. Does there already exist any study of design criteria of ...
1 vote
108 views

101 views

### A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
• 1,367