Questions tagged [block-cipher]

A block cipher is an encryption algorithm which encrypts fixed-size blocks of plaintext to same-sized blocks of ciphertext. For good ciphers every bit of the ciphertext block depends on every bit of the plaintext block and every bit of the key.

Filter by
Sorted by
Tagged with
1 vote
0 answers
34 views

Shannon's Diffusion: classical ciphers vs modern ciphers

Is there an easy to understand and intuitive "one fits all" definition for the concept of diffusion that is applicable to both modern binary cryptosystems as well as classical ciphers? For a ...
MaximumFlo's user avatar
1 vote
1 answer
210 views

ChaCha20 as a block cipher

Would it be possible to use ChaCha20 as a block cipher? With the key, the entire block function can be reversed.
SomeHybrid's user avatar
0 votes
1 answer
61 views

Can HKDF be safely used as a round function in a Feistel Cipher

Hello my question is it practical to use HKD as a round function in a Feistel Cipher I know you should not roll your own crypto, this is for learning purpose's only. Take a look at my code and let me ...
dasein's user avatar
  • 3
1 vote
0 answers
65 views

Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?

For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical. So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x ...
Bobboidsquoomy's user avatar
0 votes
0 answers
52 views

Does diffusion also include the reducibility inability of the $n$-times appliance of an encryption scheme? Or has this another name? Any proof for it?

With optimal diffusion the change of a single input bit should change every single output bit equally likely with a chance of 50% each (in mean). But this does not necessarily mean it makes it ...
UncleBob's user avatar
1 vote
1 answer
78 views

Can ECB block cipher mode be used to implement CTR?

looking at the linux kernel provided cipher and block cipher modes cat /proc/crypto my prefered mode CTR (counter/integer) is ...
humanityANDpeace's user avatar
3 votes
2 answers
105 views

How to handle padding when encrypting a value smaller than the block size

I want to encrypt numeric identifiers into ciphertexts that are deterministic and not too long. I am considering AES-128 in ECB mode to encrypt 64-bit integers. How should I pad the 64-bit integers, ...
Sjoerd's user avatar
  • 671
0 votes
0 answers
45 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
2 votes
1 answer
57 views

Midori block cipher design: importance of $S_b$ as the S-box

With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
Ranit's user avatar
  • 21
-1 votes
1 answer
81 views

Is plaintext and ciphertext absolutely one-to-one in symmetric encryption algorithms? [closed]

Known conditions: The block size of this algorithm is 16 bytes. If there are multiple encryption modes, then it is limited to ECB mode. Always use only one immutable key. Since only ECB encryption ...
S-N's user avatar
  • 127
0 votes
0 answers
62 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
0 votes
0 answers
62 views

Achieving sub-block non-malleability

I have a noisy one-way communication channel where data is sent as a series of words of width n bits. Assume n is a constant roughly in the range of 16...48. I don't want bit errors in one word to ...
Stephan Walter's user avatar
1 vote
1 answer
124 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
xyz's user avatar
  • 21
2 votes
1 answer
118 views

Does combining a stream cipher and block cipher produce any vulnerabilities?

In particular, AES-CBC with Blake2b for HMAC combined with xChacha20-Poly1305. The scheme is to encrypt with xChacha20-poly1305 first, using a key derived from a high entropy password using argon2id ...
bismofunyuns's user avatar
1 vote
0 answers
80 views

Can the requirement to increase rounds with key size be bypassed?

When taking AES for example, the number of rounds increases as the key size increases. This is done in order to adequately diffuse key bits into the state of the cipher. Suppose you replace the AES ...
LightTunnelEnd's user avatar
0 votes
0 answers
37 views

What is the security of XTS block cipher mode of operation if the key is much larger than the block size?

I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits. I ...
alpominth's user avatar
  • 393
2 votes
1 answer
68 views

n-bit addition over $GF(2^n)$ vs. addition modulo $2^n$

I am currently studying the cryptanalysis of Speck, but I am feeling confused about the addition in Speck. I am not sure whether the addition in Speck is done through n-bit addition over $GF(2^n)$ or ...
35 honglang's user avatar
0 votes
0 answers
54 views

AES-ECB attack encryption audio fie

I got two audio files one is encrypted and the other file is a part of the plaintext. I want to extract all the plaintext. I am using the AES-ECB mode, the size of the block is 128 bits and the start ...
mahouuuuuuu's user avatar
0 votes
0 answers
104 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
1 vote
1 answer
109 views

How secure is half-key Even-Mansour?

Single-key Even-Mansour is secure up to $2^{0.5 \times n}$. Where $n$ is permutation and key size. Would using $n/2$-key retain same security as $n$-key? Could the other half be used as a tweak?
LightBit's user avatar
  • 1,649
0 votes
0 answers
79 views

Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?

Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode: Full State Keyed Sponge (FKS) construction: FKS has been ...
LightTunnelEnd's user avatar
0 votes
0 answers
67 views

Having trouble providing a distinguisher proving this hash function is not collision-resistant

As suggested by the title, I'm working on an exercise where I'm given a hash function $H$ that takes in an input string $x$. I'm supposed to construct a distinguisher that proves $H$ isn't collision-...
HughJass24's user avatar
3 votes
0 answers
84 views

A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
lyrically wicked's user avatar
2 votes
1 answer
155 views

Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?

Use a block cipher in CBC mode with a public or all-0 key. Twice. Wrapping the last block into (xor) the first on the second round. Every block will depend on all previous and all successive blocks. ...
Arnold Snooli's user avatar
3 votes
1 answer
62 views

how 0/n split prevent BEAST attack against TLS?

I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way? ...
eitan's user avatar
  • 31
1 vote
1 answer
46 views

Does any encryption/decryption algorithm supports linear decomposition?

I am not sure whether "linear decomposition" is appropriate to summary my question: We know that the traditional symmetric encryption/decryption algorithm (like AES, TDES) can be written as: ...
ZKM's user avatar
  • 13
3 votes
3 answers
307 views

How big of a threat are *diffusion model* based AIs to cryptographic systems?

The diffusion model, which is used by products like Midjourney and Dall-E, trains AI systems to de-noise (remove added randomness) from data to infer what the original de-noised data is. That would ...
aiootp's user avatar
  • 785
1 vote
2 answers
323 views

Encrypting random IV in CTR mode (no nonce!)

Use of plain random-IV's in CTR mode, without any special "nonces/counters" (or any "dedicated" bits!), can lead to problems with "partial overlaps", whereby attackers ...
ManRow's user avatar
  • 343
1 vote
2 answers
83 views

Given $i$ keyed-$PRP$ labels $\ell_{i,x}$ from a $2^{256} \times 2^{256}$ Sudoku (Latin-square), how difficult is it for an adversary to solve?

There's a keyed-permutation I'm playing with, $\ell_{i,x} = \pi_i(x_i)$, which is a bijection $X \leftrightarrow X$, where $|X| = 2^{256}$, and whose evaluations on plaintext inputs $x_i$ perfectly ...
aiootp's user avatar
  • 785
1 vote
1 answer
168 views

Attacking a one-round SPN

From Introduction to Modern Cryptography, 6.2.1 Substitution-Permutation Networks A description of an optimized attack on one round SPN A better attack is possible by noting that individual bits of ...
Eshkod's user avatar
  • 43
0 votes
1 answer
61 views

May I use the same One-time pad key two times if I encrypt it with a block cipher using two different block cipher keys?

Let's suppose I have two 2GiB files and I want to encrypt them using One-time pad (Vernam cipher), but I don't want to store two big keys. May I use only one key for the two files if I encrypt the One-...
alpominth's user avatar
  • 393
1 vote
1 answer
160 views

How CTR mode is encrypted?

I referred to the explanation of encryption mode from Wikipedia, but I'm confused now, and I went to find some books about Cryptography, but it didn't solve my confusion. The CTR mode uses Counter to ...
S-N's user avatar
  • 127
4 votes
3 answers
949 views

If I encrypt a plaintext with different keys for each block, will I have the same security as a one-time pad?

Let's suppose I encrypt an 1MiB plaintext with AES-256 in ECB mode but using different keys for each 16-byte block (I know this is weird but it's just an example). Remembering that a different 256-bit ...
alpominth's user avatar
  • 393
1 vote
1 answer
70 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,645
0 votes
0 answers
37 views

Comparison of distinguishing attack against blockcipher and permutation

In a previous question, we explored various security definitions of encryption schemes, such as IND-CPA, IND-CCA{1,2,3,etc.} These indistinguishability games can roughly translate to blockciphers, as ...
DannyNiu's user avatar
  • 9,080
1 vote
0 answers
73 views

Bit based division property

Bit based division property is a great method of Integral attack on block ciphers, which was invented by Y. Todo. According to the paper Bit-Based Division Property and Application to Simon Family (in ...
R. Jalaei Salahi's user avatar
1 vote
1 answer
90 views

How many $S$-Boxes of length $3$ are there over $\mathbb{F}_{2}$?

Is there a simple way if counting the number of $S$-Boxes of length $\ell$ over $\mathbb{F}_{2}$? By $S$-box I mean an $S$-box satisfying the avalanche condition. I mean it is quite easy to see that ...
The Thin Whistler's user avatar
1 vote
0 answers
34 views

Does blockcipher decryption always offer equivalent security as blockcipher encryption? [duplicate]

I'm not sure if anyone explored this area before. Blockcipher encryption definitely fullfills IND-CCA, but what about its inverse? Is there a proof that shows blockcipher decryption is as secure as ...
DannyNiu's user avatar
  • 9,080
1 vote
1 answer
80 views

Cryptography particular block length valid message

I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
MariaDb's user avatar
  • 31
1 vote
1 answer
103 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 9,080
1 vote
2 answers
252 views

Can we still use 64-bit block ciphers?

After thinking a lot about 64-bit block ciphers, I ask a question here. Most proposed block ciphers these days seem to have a block size of at least 128-bits. Also, I know that when using a 64-bit ...
pioneer's user avatar
  • 325
1 vote
0 answers
118 views

Which encryption method support 256 bytes block size?

I am looking at some secret encryption method that apparently uses CBC and a block size of 256 bytes. I can do a chosen-ciphertext-attack. When I modify a single byte in the ciphertext a complete ...
Flole's user avatar
  • 11
1 vote
2 answers
80 views

Rule 30 based block cipher

So I went ahead an wrote this little program. What it does is it takes a password for a seed and generates a (pseudo-random) bit-pattern using rule 30 from cellular automata. It then XORs our input ...
JThree's user avatar
  • 111
0 votes
1 answer
162 views

If I encrypt two plaintexts with different keys, XOR the ciphertexts and send to an adversary, what can he/she do with what I sent?

Let's suppose I encrypt two blocks of 1MiB with AES-256 in CBC mode, each one using different keys, XOR the resulting ciphertexts and send this XORed block to an adversary. Remembering that the ...
alpominth's user avatar
  • 393
1 vote
1 answer
140 views

How does the plausible deniability used by TrueCrypt work mathematically?

I have been unable to find any mathematical explanations on how TrueCrypt's plausible deniability encryption works, when using TC containers. Would someone be able to provide a mathematical ...
securityauditor's user avatar
1 vote
1 answer
87 views

In CTR block cipher mode of operation, can I reuse the nonce with another key for encrypting another plaintext if using different counters?

Let's suppose I encrypt a plaintext with one key and a nonce in CTR block cipher mode of operation. Can I reuse the nonce with another key in another plaintext if I start the block counting with ...
alpominth's user avatar
  • 393
0 votes
0 answers
77 views

Is my domain separation in stream cipher and MAC accepted?

I would like to implement domain separation in encryption/decryption along with MAC. The encryption algorithms consists of XChaCha20,XSalsa20,SM4 From China and MAC algorithms consist of HMAC-SHA512 ...
Hern's user avatar
  • 159
1 vote
0 answers
71 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
Luce's user avatar
  • 11
-3 votes
1 answer
107 views

modern version of a book cypher [closed]

I'm a computer programmer and I'm working on a truly unbreakable cypher and I keep going back to a book cypher (each letter of the message is referenced by a page,row,and column number in a random ...
Jonathan Leslie's user avatar
5 votes
1 answer
677 views

Resistance against timing attacks of AES candidates

It's difficult to implement AES securely and efficiently if the adversary can observe the timing and (approximate) location of memory accesses, unless you have dedicated hardware. The naive ...
Gilles 'SO- stop being evil''s user avatar

1
2 3 4 5
23