Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

Filter by
Sorted by
Tagged with
39 votes
3 answers
48k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
asudhak's user avatar
  • 491
18 votes
1 answer
30k views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
CXB's user avatar
  • 321
22 votes
5 answers
9k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
danieltorres's user avatar
37 votes
2 answers
14k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
Ashwin's user avatar
  • 473
5 votes
1 answer
4k views

Is DES secure under CBC?

I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?
Jorge's user avatar
  • 51
21 votes
4 answers
22k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
Ben's user avatar
  • 375
10 votes
2 answers
3k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
Ilmari Karonen's user avatar
22 votes
3 answers
23k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
KeithS's user avatar
  • 540
5 votes
2 answers
3k views

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

Imagine conducting a padding oracle attack against CBC mode with 16-byte length blocks, and PKCS#5 used for padding. You start, as always, revealing the last byte of plaintext. Then you iteratively ...
bleg's user avatar
  • 51
47 votes
2 answers
78k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
mary's user avatar
  • 1,031
24 votes
3 answers
38k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
antonpug's user avatar
  • 341
83 votes
9 answers
138k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
midhunhk's user avatar
  • 1,151
39 votes
3 answers
11k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
Richard R. Matthews's user avatar
10 votes
3 answers
14k views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
Heathkit7's user avatar
  • 101
9 votes
4 answers
7k views

Security proofs for CBC mode

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
Dingo13's user avatar
  • 2,867
7 votes
2 answers
8k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
user avatar
6 votes
2 answers
3k views

Why can the last block contain a full block of padding in CBC Encryption?

I'm trying to understand the SSL Poodle Attack and I'm wondering why the last block of a CBC Record can be full of padding? Wouldn't that mean that the useful data was already a multiple of the key ...
Eugene K's user avatar
  • 163
4 votes
1 answer
2k views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
Gilles 'SO- stop being evil''s user avatar
14 votes
1 answer
10k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
user2398029's user avatar
33 votes
2 answers
12k views

7zip : Why does encrypting the same file with AES-256 not give the same output?

Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
super's user avatar
  • 463
15 votes
2 answers
8k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
izzle's user avatar
  • 591
10 votes
3 answers
7k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
Rook's user avatar
  • 1,496
9 votes
1 answer
9k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
Ian Boyd's user avatar
  • 1,001
6 votes
1 answer
3k views

How much data can I encrypt with AES before I need to change the key in CBC mode?

In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted. It seems that ...
makerofthings7's user avatar
92 votes
2 answers
173k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
Bob Bryan's user avatar
  • 1,283
37 votes
1 answer
51k views

What is the advantage of XTS over CBC mode (with diffuser)?

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
tommynogger's user avatar
13 votes
3 answers
16k views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
user220201's user avatar
9 votes
1 answer
1k views

CBC key lifetime, or, "how big is too big?"

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
bmedward's user avatar
8 votes
1 answer
3k views

Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
buildist's user avatar
7 votes
2 answers
18k views

Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?

I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
GarlicCheese's user avatar
6 votes
2 answers
8k views

Why does error propagation in CBC mode encryption affect two blocks?

From Wikipedia: Error propagation It was common to discuss the "error propagation" properties as a selection criterion for a mode of operation. It might be observed, for example, that a one-...
TJCLK's user avatar
  • 497
4 votes
1 answer
9k views

Forge CBC-MAC given the MAC of two messages and of their concatenation

I found this question about CBC-MAC forging and want to make sure I understand it: Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-...
FluffyBeing's user avatar
3 votes
2 answers
4k views

AES key equal to IV (CBC mode)

Application uses AES in CBC mode with 128 bit key. In this implementation key is always same and is equal to IV. Can attacker get the key or decrypt data? If he knows: First and second blocks of ...
Valeriy's user avatar
  • 39
2 votes
1 answer
2k views

Attacking CBC with predictable but encrypted IV

Let P be a secure block cipher, eg AES-128. Let's say a server has a CBC encryption oracle which uses an attacker-selected yet unique nonce to generate the IV for each message = P(key, nonce). The ...
robertkin's user avatar
  • 428
2 votes
2 answers
884 views

IV Security Clarification

After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's. There seems to be a lot of confusion and ...
Jonny Wilson's user avatar
29 votes
6 answers
5k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
matejcik's user avatar
  • 393
20 votes
2 answers
8k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
CodesInChaos's user avatar
  • 24.9k
15 votes
3 answers
2k views

Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
makerofthings7's user avatar
13 votes
3 answers
4k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
Ed Thomas's user avatar
  • 233
11 votes
3 answers
5k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
Brent.Longborough's user avatar
10 votes
1 answer
8k views

What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...
Vladislav Rastrusny's user avatar
9 votes
1 answer
11k views

Error propagation in CBC mode

Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
user220201's user avatar
7 votes
3 answers
1k views

Why is a MAC needed with CBC?

I agree that for certain encryption systems or modes of operation, a MAC is indispensible. The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
lxgr's user avatar
  • 1,798
6 votes
3 answers
6k views

Why does CBC decryption with a wrong IV still give readable results?

While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results. My encryption was correct. I was generating a random IV block and writing ...
JoelFan's user avatar
  • 295
6 votes
1 answer
2k views

What are the constraints for an IV using AES in CBC mode?

I'm designing a protocol for use into a VPN software. The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
ereOn's user avatar
  • 161
5 votes
3 answers
1k views

Does the XML Encryption flaw affect SSL/TLS?

A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated: XML Encryption Flaw Leaves Web Services Vulnerable. Does this weakness of CBC-mode which is used here also ...
zimdanen's user avatar
  • 153
5 votes
1 answer
854 views

Implementing 5 modes of operation with a hash function

Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
Malexc's user avatar
  • 53
4 votes
2 answers
1k views

How does encrypt-then-MAC protect from CCA?

I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-...
izzle's user avatar
  • 591
3 votes
1 answer
4k views

Can AES in CBC mode be parallelized?

Is there any way to parallelize AES running in CBC mode? (The plan is to parallelize it using OpenMP)
tony9099's user avatar
  • 333
3 votes
1 answer
646 views

How does padding oracle attack work with bytes larger than possible length?

I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented: Assume ...
rtur's user avatar
  • 33