Skip to main content

Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
99 votes
1 answer
169k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
Maarten Bodewes's user avatar
  • 93.2k
90 votes
4 answers
105k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
samoz's user avatar
  • 3,236
83 votes
9 answers
138k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
midhunhk's user avatar
  • 1,151
70 votes
3 answers
117k views

Why shouldn't I use ECB encryption?

I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?
Rogue's user avatar
  • 826
61 votes
4 answers
126k views

Difference between stream cipher and block cipher

I read that A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. (...
Ravindra Bagale's user avatar
60 votes
6 answers
57k views

Why is AES resistant to known-plaintext attacks?

At least it's my understanding that AES isn't affected by known-plaintext. Is it immune to such an attack, or just resistant? Does this vary for chosen-plaintext?
Jeff Ferland's user avatar
54 votes
2 answers
40k views

Why use an Initialization Vector (IV)?

Why use an Initialization Vector (IV)? How are IV's used? What are the advantages/disadvantages of using an IV? Why use an IV instead of a longer key in which some section of the key is public? What ...
Ethan Heilman's user avatar
50 votes
3 answers
19k views

What are the benefits of the two permutation tables in DES?

Why do we use a permutation table in the first step of DES algorithm and one at the end of the algorithm?
Am1rr3zA's user avatar
  • 755
46 votes
7 answers
11k views

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world. How can we reason about the symmetric ciphers cryptanalysis ...
jokoon's user avatar
  • 713
42 votes
3 answers
21k views

Why does nobody use (or break) the Camellia Cipher?

If Camellia is of equivalent security and speed to AES, concerns arise. First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does ...
Chris Smith's user avatar
  • 1,192
36 votes
3 answers
5k views

What are recommended, general strategies to start block-cipher design and/or analysis?

I (and many others for that matter) have always been fascinated by the inner workings of the modern building block of cryptography: block ciphers. Now, the resources on the "black art" of ...
SEJPM's user avatar
  • 46.1k
34 votes
2 answers
18k views

Why is MixColumns omitted from the last round of AES?

All rounds of AES (and Rijndael) have a MixColumns step, save the last round which omits it. DES has a similar feature where the last round differs slightly. The rationale, if I recall correctly, ...
Fixee's user avatar
  • 4,168
31 votes
2 answers
5k views

How do I apply differential cryptanalysis to a block cipher?

I have read a lot of summaries of block ciphers particularly with regards to the NIST competitions stating that reduced-round block ciphers are – for example – vulnerable to differential cryptanalysis....
user avatar
30 votes
2 answers
18k views

Can someone explain the ECB Penguin?

I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords. Aren't the people who create these ...
Josh Bond's user avatar
  • 411
27 votes
2 answers
79k views

How to solve MixColumns

I can't really understand MixColumns in the Advanced Encryption Standard, can anyone help me how to do this? I found some topics on the internet about MixColumns, but I still have a lot of questions ...
goldroger's user avatar
  • 1,737
26 votes
3 answers
11k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
David's user avatar
  • 443
25 votes
3 answers
10k views

What is the ideal cipher model?

What is the ideal cipher model? What assumptions does it make about a block cipher? How does it relate to assuming that my block cipher is a pseudo-random permutation (PRP)? When is the ideal ...
D.W.'s user avatar
  • 36.5k
24 votes
7 answers
10k views

Turning a cipher into a hashing function

This is theoretical question. I'd like to know if it's possible (and what are eventually the consequences), not that I'm going to do it in one of my projects. ;) The first hashing functions created ...
Marek Puchalski's user avatar
24 votes
4 answers
6k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
John Gietzen's user avatar
  • 1,505
24 votes
2 answers
6k views

How exactly was the finalist chosen in the NIST AES competition?

I was just reading the Stick Figure Guide to AES and came across an interesting table explaining how the winner was chosen: Unfortunately the NIST site is down so I can't gain further information ...
J_M's user avatar
  • 341
23 votes
3 answers
3k views

How to publish a cipher (concept)?

In the last months I was searching for a subject for my bachelor thesis. I came up with an idea for a new cipher concept that works by combining already known techniques in a (hopefully) new way. So ...
masinger's user avatar
  • 463
22 votes
5 answers
9k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
danieltorres's user avatar
22 votes
3 answers
38k views

How long does it take to crack DES and AES?

Suppose that a single evaluation of a block-cipher (DES or AES) takes 10 operations, and the computer can do $10^{15}$ such operations per second. How long would it take for to recover a DES key, ...
huyichen's user avatar
  • 773
21 votes
1 answer
16k views

Difference between Rijndael 128 / 256 blocksize implementations? (and impact of block size in general)

Can anyone shed some light onto the advantages/disadvantages of using Rijndael with 256-bit block size, as opposed to the 128-bit (AES) implementation? (please note: I'm not referring to key-size here)...
hunter's user avatar
  • 3,975
21 votes
1 answer
3k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
zwol's user avatar
  • 785
21 votes
1 answer
26k views

How to choose a padding mode with AES

Depending on the framework you are using, there are various padding modes that can be used with AES encryption. For example, with .NET we can choose PKCS7, ISO10126, ANSIX923, Zeros or None. I ...
Cocowalla's user avatar
  • 450
20 votes
3 answers
7k views

Are there any secure commutative ciphers?

This answer lists two commutative cipher algorithms - Pohlig-Hellman and SRA. However, they don't appear to be too secure. My question is, here there any commutative ciphers out there that are secure ...
ThePiachu's user avatar
  • 1,679
19 votes
4 answers
6k views

Is SHA-256 secure as a CTR block cipher?

Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x. We represent numbers in simple binary instead of a counting function. <...
Jordan's user avatar
  • 575
19 votes
2 answers
2k views

Does AES have any fixed-points?

Is there any pair of 128-bit strings M and K such that AES$_K$(M) = M? If yes, how do I go about (efficiently) finding such a pair?
Fixee's user avatar
  • 4,168
19 votes
3 answers
11k views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
Maarten Bodewes's user avatar
  • 93.2k
18 votes
7 answers
5k views

Isn't AES-NI useless because now the key length need to be longer?

AES-NI speeds up both encryption and decryption. The encryption is as secure as the time needed to brute force the decryption. Doesn't it mean that the application developers will just need to ...
cnvzmxcvmcx's user avatar
18 votes
3 answers
6k views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-...
lynks's user avatar
  • 283
18 votes
3 answers
3k views

Can you create a strong blockcipher with small blocksize, given a strong blockcipher of conventional blocksize?

Suppose I want a strong 20-bit blockcipher. In other words, I want a function that takes a key (suppose the key is 128 bits), and implements a permutation from 20 bits to 20 bits. The set of ...
Fixee's user avatar
  • 4,168
18 votes
1 answer
8k views

Is TEA considered secure?

Wikipedia claims that the best attack on the surprisingly simple TEA block cipher, that isn't a related-key attack, has a time complexity of $2^{121.5}$. So despite how unsophisticated the cipher ...
ithisa's user avatar
  • 1,101
18 votes
3 answers
82k views

AES256-CBC vs AES256-CTR in SSH [duplicate]

I used AES256-CBC to SSH to a remote server. Recently, it stopped working with the following message: ...
Rlearner's user avatar
  • 283
17 votes
2 answers
31k views

Can you explain “weak keys” for DES?

A weak key for DES is a key $K$ such that $DES_{k_1}(DES_{k_2}(x))=x$ for all $x$. I don't get why are the 4 keys $k_1||k_2$: $1^{112}$, $0^{112}$, $0^{56}||1^{56}$, $1^{56}||0^{56}$ considered as ...
Bush's user avatar
  • 2,140
16 votes
1 answer
2k views

Replacing the Rijndael S-Box?

The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
bzc's user avatar
  • 535
16 votes
1 answer
742 views

Selection of rotation constants in ARX design

My question is about choosing the rotation values in ARX design such as SIMON-like or SPECK-like ciphers to provide optimal differential and linear immunity. According to this, the selection of $a$ ...
hardyrama's user avatar
  • 2,136
15 votes
3 answers
5k views

Security of simple xor and s-box cipher?

What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode? A cipher's internal primitive might be a simple as this: $C = S[M \oplus k]$, where $...
Polynomial's user avatar
  • 3,527
15 votes
2 answers
23k views

AES in ECB mode weakness

In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long. Very ...
jjsanchez's user avatar
  • 253
15 votes
2 answers
2k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
Mike's user avatar
  • 315
14 votes
2 answers
12k views

Why don't we use Blowfish if it hasn't been cracked?

Since Blowfish is old, well-audited, and has no published attacks, why are we using AES instead? I know that Bruce Schneier said that Blowfish is insecure and told people to transition to Twofish, but ...
Evan Su's user avatar
  • 449
14 votes
1 answer
48k views

What is the difference between key size and block size (for AES)?

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does ...
xyz's user avatar
  • 159
14 votes
1 answer
6k views

Why is CAMELLIA suddenly so widely used?

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available. Is that not ...
MKK's user avatar
  • 251
14 votes
3 answers
5k views

Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
Fixee's user avatar
  • 4,168
14 votes
3 answers
2k views

Can one claim that AES is a perfect cipher?

I'm taking a crypto class this semester and after learning the definition of a perfect cipher. I started wondering how this definition applies to AES. Obviously AES isn't a perfect cipher, since the ...
sol's user avatar
  • 141
14 votes
1 answer
606 views

Can a commutative block cipher be indistinguishable from a random one, assuming a random permutation of keyspace?

Define a commutative block cipher with keyspace the finite set $K$, and message space the finite set $S$, to be an application $$\begin{align} E:K\times S&\mapsto S\\ (k,x)&\mapsto E(k,x)\text{...
fgrieu's user avatar
  • 142k
13 votes
1 answer
2k views

Formally, what is AES?

AES is supposed to be a symmetric key block cipher. The theoretical counterpart to this is a pseudorandom permutation. I'd like to say that AES is a PRP (well, supposedly at least), but that doesn't ...
extremeaxe5's user avatar
13 votes
3 answers
13k views

How does the key schedule of Rijndael looks for keysizes other than 128 bit?

It said in Wikipedia that: [....] Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits. The blocksize has a maximum of 256 bits, but the keysize ...
goldroger's user avatar
  • 1,737
13 votes
3 answers
4k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
Ed Thomas's user avatar
  • 233

1
2 3 4 5
23