Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
488
questions
0
votes
1
answer
74
views
CBC KEY recovery when KEY=IV
We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server?
...
- 145k
0
votes
0
answers
124
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
CommunityBot
- 1
1
vote
1
answer
99
views
Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?
This is a follow up question to:
Bit Flipping Attack on CBC Mode
which demonstrates that a bit flipping attack with a known IV is possible on CBC mode.
Is it safe to assume that the bit flicking ...
- 91.8k
2
votes
1
answer
143
views
Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?
Use a block cipher in CBC mode with a public or all-0 key. Twice.
Wrapping the last block into (xor) the first on the second round.
Every block will depend on all previous and all successive blocks. ...
- 47.6k
3
votes
1
answer
56
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 145k
0
votes
1
answer
68
views
How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?
I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data.
It's a black box challenge, but managed to figure out the ...
- 24.8k
0
votes
1
answer
45
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 145k
2
votes
1
answer
208
views
Which encryption technique should be adopted to keep the search functionalities?
I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
CommunityBot
- 1
0
votes
0
answers
522
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
2
votes
0
answers
49
views
Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?
I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
- 21
1
vote
1
answer
340
views
CBC not CCA secure
I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
CommunityBot
- 1
2
votes
1
answer
324
views
Padding Oracle Attack Example
I try to understand a oracle Padding Oracle Attack example. I try to solve this question but I didn't figure out the answer.
A 7-byte message is padded per PKCS#5 and encrypted using the CBC mode of ...
- 138k
1
vote
1
answer
76
views
Cryptography particular block length valid message
I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
- 138k
2
votes
1
answer
484
views
Padding Oracle Attack - Decrypting First Block with Static IV
I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key.
Can encrypted data with the ...
- 909
2
votes
0
answers
48
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
1
vote
2
answers
139
views
Role of IV in Perl's Crypt::Rijndael
Sorry in advance if I'm asking a stupid question:
I thought the role of "IV" in encryption is to avoid having identical ciphertext for identical plaintext.
So one could use some random IV.
...
- 5,786
0
votes
1
answer
1k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CommunityBot
- 1
3
votes
1
answer
2k
views
How do I calculate the maximum plain text length allowable for a certain cipher text length?
I am encrypting and storing sensitive values in the database. I have a set max length in the database, but in order to provide useful user feedback, I'd like to know the max input I should allow for a ...
- 133
3
votes
1
answer
81
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 138k
1
vote
1
answer
79
views
Can one infer concatenated ciphertext block boundaries through digital forensics?
Say one encrypts multiple plain text blocks with same IV but different keys using AES-256-CBC, can one infer concatenated ciphertext block boundaries through digital forensics?
Example
Plain text ...
CommunityBot
- 1
0
votes
1
answer
411
views
How to encrypt with CBC, step by step?
I have this message "Hello from another world"
Can you explain how to encrypt it with CBC step by step?
Are the message characters ...
- 15.1k
-1
votes
1
answer
126
views
How is DES used with CBC?
I'm reading our school's notes for cryptography, and it does a good job explaining CBC and DES in detail, but it fails to provide good information on how they are related.
From what I've researched so ...
- 21.2k
6
votes
2
answers
1k
views
Always set the IV to 0 randomized CBC
Please explain what goes wrong if we always set the IV to 0 in randomized CBC, and use the system to encrypt two different messages m0 /= m1 with the same key k.
I ...
- 185
91
votes
2
answers
170k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
17
votes
1
answer
27k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 1
1
vote
0
answers
159
views
AES-CBC collision resistance of hash function [closed]
I'm very new to cryptography and am having some issues with the following question
...
- 11
1
vote
0
answers
124
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
1
answer
186
views
Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?
I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).
I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
- 47.6k
0
votes
0
answers
52
views
CBC Operation with Known IV [duplicate]
I am trying to understand how XOR operation can lead us to know the plaintext if we can predict the iv using the chosen plaintext attack game.
- 161
0
votes
0
answers
287
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
2
votes
1
answer
150
views
what is IV predictable?
What is IV predictable in the CBC mode?
We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
- 138k
3
votes
3
answers
4k
views
Is there a security risk to use AES-CBC as stream cipher?
I am building a chat application where I want to encrypt each character while they are typing. I would require a stream cipher for that.
I am planning to use AES-CBC mode with HMAC. Are there any ...
- 47.6k
0
votes
0
answers
107
views
Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?
I know this is theoretically bad practice, but please bear with me…
Assuming following spec:
Salt and IV are randomly generated using cryptographically-secure RNG.
Argon2 is used as KDF so ...
- 189
7
votes
3
answers
5k
views
What is DES-EDE3-CBC?
I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is.
Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode.
EDE is probably ...
- 138k
1
vote
1
answer
69
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 91.8k
2
votes
2
answers
587
views
What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?
I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03.
According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
- 91.8k
3
votes
2
answers
292
views
Is disabling padding integrity check in CBC implementations a good way of overcoming / mitigating padding oracle attack?
Given that CBC mode has a padding oracle attack, would disabling the padding integrity check be a good way of overcoming the vulnerability (this may result in frustration among existing users with ...
2
votes
2
answers
256
views
AES CBC: When to use new IV
I am trying to figure out when to use a new IV for an AES-CBC communication and whether my approach is safe.
Here is a quote from Thomas Pornin from a similar question:
So, to sum up: you must choose ...
- 2,971
0
votes
1
answer
550
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 11.7k
8
votes
2
answers
1k
views
Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
I was not able to understand why we practically need a CPA security in Cipher Block Chaining, which insist on having a random IV. Let's say if the encryption is not CPA secure, i.e. the adversary can ...
- 111
1
vote
0
answers
68
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 877
1
vote
0
answers
59
views
Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]
Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
- 47.6k
2
votes
2
answers
1k
views
AES output lengths are not always a multiple of 16
I have a C# solution that encrypts a bunch of small data chunks using AES.
...
- 121
2
votes
2
answers
559
views
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?
I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
7
votes
2
answers
16k
views
Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?
I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
- 91.8k
0
votes
0
answers
153
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
1
vote
2
answers
1k
views
Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?
The following details are given:
Partial Key: ...
- 47.6k
0
votes
1
answer
153
views
Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?
I was trying to do a simple CPA attack against this scheme, to understand better the concept.
Instead of using a new 𝐼𝑉 each time, we decide to use the last block
of the previous ciphertext as an ...
5
votes
1
answer
4k
views
Is DES secure under CBC?
I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?
CommunityBot
- 1