Skip to main content

Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
3 votes
2 answers
113 views

What are advantages/disadvantages of an invertible tweak schedule in a tweakable block cipher?

I have been doing research on a tweakable block cipher called BipBip. This is a rather niche cipher so I'll give a few facts about it for background before asking my question: The structure is based ...
Tw1ZZLER's user avatar
0 votes
0 answers
41 views

Parallel block cipher in CTR mode and variable number of threads: how to deal with internal state and permit decryption?

I'm implementing a parallel block cipher (Morus, to be precise) in CTR mode and I'd like to make it flexible with respect to the number of threads. It is not difficult per se, as I can partition the ...
biagiop1986's user avatar
4 votes
1 answer
185 views

How to prove the conclusion " linear operation $\mathsf{XOR}$ does not affect the division property"?

Division property is proposed as a generalized integral property at Eurocrypt 2015 by Yosuke Todo in his paper Structural evaluation by generalized integral property, And in paper Integral ...
L0ngx1ng's user avatar
  • 143
1 vote
1 answer
48 views

Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?

Let $$M= \begin{bmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{bmatrix}$$ which is used in the block ciphers MIDORI and MANTIS. Of course this matrix ...
Kurious Koder's user avatar
2 votes
1 answer
68 views

Which was the first cipher that used the Maximum distance separable (MDS) matrix?

MDS matrices are used in the diffusion layer of block ciphers. I am interested in knowing who was the first researcher(s) who used an MDS matrix in their cipher. Thanks in advance.
Kurious Koder's user avatar
5 votes
1 answer
1k views

Can unauthenticated encryption be broken if the encrypted data looks random?

If we have some random data (with length a multiple of block size to avoid padding) and encrypt it with a block cipher with a weak key (maybe it's derived from a four digit number for example), would ...
n-l-i's user avatar
  • 752
1 vote
0 answers
73 views

New Impossible Differential Attacks on AES reduce time complexity

I am interested in the following snippet from the paper New Impossible Differential Attacks on AES. Analysis of Steps 3–4 of the 7-Round Attack in the 8-Round Attack The most time consuming steps of ...
can balıkçı's user avatar
0 votes
1 answer
55 views

Does truncating a CBC ciphertext result in a truncated plaintext?

I want to know why in the CBC cipher, if we truncate the first block in the ciphertext then the corresponding plaintext block is truncated in the same way. I have an equation for the plaintext $m_i$ ...
revision's user avatar
2 votes
0 answers
29 views

Can a differential attack on FEAL4 yield multiple valid keys?

For my version of this attack I used the FEAL4 version depicted here http://theamazingking.com/crypto-feal.php and in the book "Applied Cryptanalysis Breaking Ciphers in the Real World -- Mark ...
curious_cryptocopter's user avatar
2 votes
0 answers
46 views

Design criteria of block ciphers in quantum setting

Some design criteria of block ciphers are already known for the resistance against known attacks like differential, linear , boomerang, etc. Does there already exist any study of design criteria of ...
Ranit Dutta's user avatar
1 vote
1 answer
106 views

When using AES, is doing encryption followed by decryption with the same key efficient?

It seems that rekeying between block cipher calls of AES is expensive. Meaning that calling $AESenc(K_1,M_1)$ and then calling $AESenc(K_2,M_2)$ with $K_1 \ne K_2$ is slower than calling $AESenc(K_1,...
Morz's user avatar
  • 55
1 vote
1 answer
54 views

Differential uniformity of vectorial Boolean function

What could we say about differential uniformity of (a vectorial Boolean function) $F = f+g \pmod 2$ (i.e. XOR) in terms of differential uniformity of $f$ and $g$?
Ranit Dutta's user avatar
1 vote
1 answer
189 views

Statistical differences between ciphertexts generated by AES in ECB vs CBC mode?

Given two ciphertexts encrypting the same (natural language) plaintext, where we know that one of the ciphertexts was encrypted with AES-CBC (and unknown IV) and one was encrypted with AES in EBC mode,...
mudskipper's user avatar
0 votes
0 answers
19 views

Understanding the Simplified Perspective in OCB Security Proof: Exploring the Role of Collisions and Oracle Models

In the security proof of OCB (Offset Codebook Mode), it appears that only collisions at the input and output of the block cipher are considered. Typically, security proofs for cryptographic modes ...
NogaCS's user avatar
  • 1
3 votes
1 answer
278 views

Are block ciphers still relevant in 2024?

Is the general approach of block ciphers still relevant when we have secure and performant pure stream ciphers? For example, TLS 1.3 supports both AES-GCM and chacha20-Poly1305. But I don't understand ...
Mr. B's user avatar
  • 129
0 votes
1 answer
69 views

Can I prove AES-GCM nonce reuse just from the bytes?

I have AES-GCM output with GMAC tag. The plaintext consists of some bitfields I know the structure of. When I generate input which should only affect timestamps and counters in very specific bytes, I ...
nusch's user avatar
  • 1
0 votes
0 answers
30 views

In Vigenère, if I encrypt a plaintext with a block cipher before applying the key, will it be possible to recover the key if it repeats?

This question may seem related to this one, but it is not the same. Let's suppose I take 1GiB of data, encrypt the data with a (secure) block cipher and apply the Vigenère key, being the key much ...
alpominth's user avatar
  • 393
0 votes
0 answers
56 views

Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
Kurious Koder's user avatar
5 votes
1 answer
249 views

New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
hardyrama's user avatar
  • 2,136
1 vote
1 answer
124 views

BLAKE3 for Block and Stream ciphers?

When assuming the following idea for ciphers: For a block cipher, a 4-round balanced Feistel network where the PRF is BLAKE3 and the key schedule is: input key, input key with every odd bit flipped, ...
user115528's user avatar
3 votes
2 answers
199 views

Shannon's Diffusion: classical ciphers vs modern ciphers

Is there an easy to understand and intuitive "one fits all" definition for the concept of diffusion that is applicable to both modern binary cryptosystems as well as classical ciphers? For a ...
MaximumFlo's user avatar
1 vote
1 answer
337 views

ChaCha20 as a block cipher

Would it be possible to use ChaCha20 as a block cipher? With the key, the entire block function can be reversed.
somehybrid's user avatar
0 votes
1 answer
69 views

Can HKDF be safely used as a round function in a Feistel Cipher

Hello my question is it practical to use HKD as a round function in a Feistel Cipher I know you should not roll your own crypto, this is for learning purpose's only. Take a look at my code and let me ...
dasein's user avatar
  • 3
1 vote
0 answers
84 views

Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?

For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical. So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x ...
Bobboidsquoomy's user avatar
1 vote
1 answer
84 views

Can ECB block cipher mode be used to implement CTR?

looking at the linux kernel provided cipher and block cipher modes cat /proc/crypto my prefered mode CTR (counter/integer) is ...
humanityANDpeace's user avatar
3 votes
2 answers
225 views

How to handle padding when encrypting a value smaller than the block size

I want to encrypt numeric identifiers into ciphertexts that are deterministic and not too long. I am considering AES-128 in ECB mode to encrypt 64-bit integers. How should I pad the 64-bit integers, ...
Sjoerd's user avatar
  • 671
0 votes
0 answers
63 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
3 votes
1 answer
79 views

Midori block cipher design: importance of $S_b$ as the S-box

With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
Ranit's user avatar
  • 31
-1 votes
1 answer
82 views

Is plaintext and ciphertext absolutely one-to-one in symmetric encryption algorithms? [closed]

Known conditions: The block size of this algorithm is 16 bytes. If there are multiple encryption modes, then it is limited to ECB mode. Always use only one immutable key. Since only ECB encryption ...
S-N's user avatar
  • 127
0 votes
0 answers
70 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
0 votes
0 answers
69 views

Achieving sub-block non-malleability

I have a noisy one-way communication channel where data is sent as a series of words of width n bits. Assume n is a constant roughly in the range of 16...48. I don't want bit errors in one word to ...
Stephan Walter's user avatar
1 vote
1 answer
131 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
xyz's user avatar
  • 21
2 votes
1 answer
120 views

Does combining a stream cipher and block cipher produce any vulnerabilities?

In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305. The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
bismofunyuns's user avatar
1 vote
0 answers
82 views

Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
LightTunnelEnd's user avatar
0 votes
0 answers
40 views

What is the security of XTS block cipher mode of operation if the key is much larger than the block size?

I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits. I ...
alpominth's user avatar
  • 393
2 votes
1 answer
73 views

n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$

I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
35 honglang's user avatar
0 votes
0 answers
63 views

AES-ECB attack encryption audio fie

I got two audio files one is encrypted and the other file is a part of the plaintext. I want to extract all the plaintext. I am using the AES-ECB mode, the size of the block is 128 bits and the start ...
mahouuuuuuu's user avatar
0 votes
0 answers
110 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
1 vote
1 answer
134 views

How secure is half-key Even-Mansour?

Single-key Even-Mansour is secure up to $2^{0.5 \times n}$. Where $n$ is permutation and key size. Would using $n/2$-key retain same security as $n$-key? Could the other half be used as a tweak?
LightBit's user avatar
  • 1,659
0 votes
0 answers
82 views

Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?

Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode: Full State Keyed Sponge (FKS) construction: FKS has been ...
LightTunnelEnd's user avatar
0 votes
0 answers
80 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
3 votes
0 answers
95 views

A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
lyrically wicked's user avatar
2 votes
1 answer
159 views

Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?

Use a block cipher in CBC mode with a public or all-0 key. Twice. Wrapping the last block into (xor) the first on the second round. Every block will depend on all previous and all successive blocks. ...
Arnold Snooli's user avatar
3 votes
1 answer
74 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
eitan's user avatar
  • 31
1 vote
1 answer
51 views

Does any encryption/decryption algorithm supports linear decomposition?

I am not sure whether "linear decomposition" is appropriate to summary my question: We know that the traditional symmetric encryption/decryption algorithm (like AES, TDES) can be written as: ...
ZKM's user avatar
  • 13
3 votes
3 answers
339 views

How big of a threat are *diffusion model* based AIs to cryptographic systems?

The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
aiootp's user avatar
  • 814
1 vote
2 answers
342 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 343
1 vote
2 answers
85 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 814
1 vote
1 answer
212 views

Attacking a one-round SPN

From Introduction to Modern Cryptography, 6.2.1 Substitution-Permutation Networks A description of an optimized attack on one round SPN A better attack is possible by noting that individual bits of ...
Eshkod's user avatar
  • 43
0 votes
1 answer
72 views

May I use the same One-time pad key two times if I encrypt it with a block cipher using two different block cipher keys?

Let's suppose I have two 2GiB files and I want to encrypt them using One-time pad (Vernam cipher), but I don't want to store two big keys. May I use only one key for the two files if I encrypt the One-...
alpominth's user avatar
  • 393

1
2 3 4 5
23