Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
487
questions
-1
votes
1
answer
49
views
Padding oracle attack when padding is on prefix
Is there any attack on padding Oracle AES-CBC encryption when padding is added as a prefix instead of suffix or is it secure completely
2
votes
1
answer
131
views
Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?
Use a block cipher in CBC mode with a public or all-0 key. Twice.
Wrapping the last block into (xor) the first on the second round.
Every block will depend on all previous and all successive blocks. ...
-4
votes
0
answers
81
views
CTF - AES CBC Challenge
I am currently facing a CTF training challenge which is based on AES CBC and exploiting the fact that the IV is known.
This is the challenge:
...
- 137
3
votes
1
answer
52
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31
0
votes
1
answer
64
views
How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?
I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data.
It's a black box challenge, but managed to figure out the ...
- 173
0
votes
1
answer
42
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
0
votes
0
answers
206
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 137
2
votes
0
answers
42
views
Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?
I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
- 21
1
vote
1
answer
150
views
CBC not CCA secure
I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
- 19
2
votes
1
answer
207
views
Padding Oracle Attack Example
I try to understand a oracle Padding Oracle Attack example. I try to solve this question but I didn't figure out the answer.
A 7-byte message is padded per PKCS#5 and encrypted using the CBC mode of ...
- 31
1
vote
1
answer
67
views
Cryptography particular block length valid message
I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
- 31
2
votes
1
answer
229
views
Padding Oracle Attack - Decrypting First Block with Static IV
I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key.
Can encrypted data with the ...
- 23
2
votes
0
answers
36
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
1
vote
2
answers
112
views
Role of IV in Perl's Crypt::Rijndael
Sorry in advance if I'm asking a stupid question:
I thought the role of "IV" in encryption is to avoid having identical ciphertext for identical plaintext.
So one could use some random IV.
...
- 163
3
votes
1
answer
71
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
0
votes
1
answer
246
views
How to encrypt with CBC, step by step?
I have this message "Hello from another world"
Can you explain how to encrypt it with CBC step by step?
Are the message characters ...
-1
votes
1
answer
70
views
How is DES used with CBC?
I'm reading our school's notes for cryptography, and it does a good job explaining CBC and DES in detail, but it fails to provide good information on how they are related.
From what I've researched so ...
6
votes
2
answers
1k
views
Always set the IV to 0 randomized CBC
Please explain what goes wrong if we always set the IV to 0 in randomized CBC, and use the system to encrypt two different messages m0 /= m1 with the same key k.
I ...
- 185
1
vote
0
answers
119
views
AES-CBC collision resistance of hash function [closed]
I'm very new to cryptography and am having some issues with the following question
...
- 11
1
vote
0
answers
88
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
1
answer
179
views
Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?
I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).
I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
- 189
0
votes
0
answers
52
views
CBC Operation with Known IV [duplicate]
I am trying to understand how XOR operation can lead us to know the plaintext if we can predict the iv using the chosen plaintext attack game.
- 151
0
votes
1
answer
747
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 151
0
votes
0
answers
284
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
2
votes
1
answer
131
views
what is IV predictable?
What is IV predictable in the CBC mode?
We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
- 23
1
vote
1
answer
77
views
Can one infer concatenated ciphertext block boundaries through digital forensics?
Say one encrypts multiple plain text blocks with same IV but different keys using AES-256-CBC, can one infer concatenated ciphertext block boundaries through digital forensics?
Example
Plain text ...
- 189
3
votes
3
answers
3k
views
Is there a security risk to use AES-CBC as stream cipher?
I am building a chat application where I want to encrypt each character while they are typing. I would require a stream cipher for that.
I am planning to use AES-CBC mode with HMAC. Are there any ...
- 257
0
votes
0
answers
93
views
Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?
I know this is theoretically bad practice, but please bear with me…
Assuming following spec:
Salt and IV are randomly generated using cryptographically-secure RNG.
Argon2 is used as KDF so ...
- 189
7
votes
3
answers
4k
views
What is DES-EDE3-CBC?
I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is.
Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode.
EDE is probably ...
- 253
1
vote
1
answer
66
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
2
votes
2
answers
522
views
What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?
I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03.
According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
- 21
3
votes
2
answers
259
views
Is disabling padding integrity check in CBC implementations a good way of overcoming / mitigating padding oracle attack?
Given that CBC mode has a padding oracle attack, would disabling the padding integrity check be a good way of overcoming the vulnerability (this may result in frustration among existing users with ...
- 204
2
votes
2
answers
237
views
AES CBC: When to use new IV
I am trying to figure out when to use a new IV for an AES-CBC communication and whether my approach is safe.
Here is a quote from Thomas Pornin from a similar question:
So, to sum up: you must choose ...
- 165
0
votes
1
answer
478
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 204
1
vote
0
answers
60
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 867
1
vote
0
answers
57
views
Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]
Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
- 17
2
votes
2
answers
1k
views
AES output lengths are not always a multiple of 16
I have a C# solution that encrypts a bunch of small data chunks using AES.
...
- 121
2
votes
2
answers
482
views
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?
I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
- 121
0
votes
0
answers
145
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
1
vote
2
answers
967
views
Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?
The following details are given:
Partial Key: ...
- 21
0
votes
1
answer
118
views
Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?
I was trying to do a simple CPA attack against this scheme, to understand better the concept.
Instead of using a new 𝐼𝑉 each time, we decide to use the last block
of the previous ciphertext as an ...
0
votes
0
answers
26
views
CBC byte flipping attack [duplicate]
I'm learning how CBC works but i don't understand when altering the first 2 bytes of the ciphered text why the 1rst block and ONLY the first 2 bytes of the second block are altered. The first 2 bytes ...
2
votes
1
answer
1k
views
Can you use RSA in “CBC mode”?
Are there any security concerns with using RSA in “CBC mode”?
Specifically: if I use RSA encryption as my block cipher operation, and apply the standard CBC mode operations including a random IV, will ...
0
votes
1
answer
178
views
Is multiple encryption using CBC mode of operation susceptible to Meet-in-the-middle attacks?
I read it once on a page (I don't remember the link and I coundn't find it) that said about a cascade of AES with two 256-bits keys and that it provides 384-bits of security. Maybe not 512-bits of ...
- 867
0
votes
1
answer
243
views
Is CBC mode of encryption still safe as long as it's not use to send messages over a network?
I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me.
But base on my little ...
- 105
1
vote
2
answers
307
views
changing messages for authentication without the tag changed. (CBC-MAC)
do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
- 21
2
votes
2
answers
941
views
Why bother to generate Key, IV and encrypt them?
When we perform encryption with Public or Private Key, Asymmetric AES with RSA and CBC 128, and when we use the padding as well. Why do we have to bother adding the additional:
Key + IV?
...
John Smith
2
votes
2
answers
867
views
Distinguishing the correct IV from incorrect IV in AES CBC when key is known
Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
1
vote
1
answer
2k
views
Decrypt AES-128-CBC encypted partial RSA Key
I am given a private RSA key, which header indicates that it is AES-128-CBC encypted. Note that the last ten lines of the key are missing. (This is part of an educational task.)
...
- 111
3
votes
1
answer
149
views
Why does CBC-MAC(M) = CFB-MAC(M)?
I don't understand why $\text{CBC-MAC}(M) = \text{CFB-MAC}(M)$. Has it something to do with $\text{CBC-MAC}(M) = C_L$ and $\text{CFB-MAC}(M) = E_K(C'_{L-1})$?
- 31