Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
103
questions
39
votes
3
answers
47k
views
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
- 491
17
votes
1
answer
26k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 311
22
votes
5
answers
9k
views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
- 415
37
votes
2
answers
13k
views
Why should I use an Initialization Vector (IV) when I have unique keys?
I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same.
I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
- 473
5
votes
1
answer
4k
views
Is DES secure under CBC?
I know DES is outdated, but will is is secure in CBC mode? Can anyone help me understand why not?
- 51
20
votes
4
answers
21k
views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is it?...
- 365
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
- 45.9k
21
votes
3
answers
22k
views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
- 530
47
votes
2
answers
75k
views
AES CBC mode or AES CTR mode recommended?
What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
- 1,031
24
votes
3
answers
38k
views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
- 341
5
votes
2
answers
3k
views
During padding oracle attack (CBC), how is first byte of plaintext block is obtained?
Imagine conducting a padding oracle attack against CBC mode with 16-byte length blocks, and PKCS#5 used for padding.
You start, as always, revealing the last byte of plaintext. Then you iteratively ...
- 51
83
votes
9
answers
137k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
39
votes
3
answers
10k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,415
10
votes
3
answers
13k
views
How to break AES/CBC/PKCS5 when key and IV are reused?
I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
- 101
9
votes
4
answers
7k
views
Security proofs for CBC mode
I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
- 2,837
7
votes
2
answers
7k
views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
antisane
6
votes
2
answers
3k
views
Why can the last block contain a full block of padding in CBC Encryption?
I'm trying to understand the SSL Poodle Attack and I'm wondering why the last block of a CBC Record can be full of padding? Wouldn't that mean that the useful data was already a multiple of the key ...
- 163
4
votes
1
answer
2k
views
Does CBC encryption of a hash provide authenticity?
Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
14
votes
1
answer
9k
views
Reusing keys with AES-CBC
I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.
Is reusing the same key several ...
- 523
33
votes
2
answers
11k
views
7zip : Why does encrypting the same file with AES-256 not give the same output?
Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
- 463
15
votes
2
answers
8k
views
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
- 581
10
votes
3
answers
7k
views
Malleability attacks against encryption without authentication
Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block:
...
- 1,486
9
votes
1
answer
9k
views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
- 1,001
6
votes
1
answer
3k
views
How much data can I encrypt with AES before I need to change the key in CBC mode?
In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.
It seems that ...
- 2,601
91
votes
2
answers
170k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,273
36
votes
1
answer
49k
views
What is the advantage of XTS over CBC mode (with diffuser)?
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
- 463
13
votes
3
answers
15k
views
Difference between a nonce and IV
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
- 861
9
votes
1
answer
1k
views
CBC key lifetime, or, "how big is too big?"
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
- 93
8
votes
1
answer
3k
views
Importance of block size in CBC mode
Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
- 83
7
votes
2
answers
15k
views
Is the Java function AES/CBC/PKCS5Padding vulnerable to padding oracle?
I have an application that stores data on the devices. Currently AES/CBC/PKCS5Padding from javax.crypto.Cipher(see reference) is ...
- 73
6
votes
2
answers
8k
views
Why does error propagation in CBC mode encryption affect two blocks?
From Wikipedia:
Error propagation
It was common to discuss the "error propagation" properties as a selection criterion for a mode of operation. It might be observed, for example, that a one-...
- 477
4
votes
1
answer
9k
views
Forge CBC-MAC given the MAC of two messages and of their concatenation
I found this question about CBC-MAC forging and want to make sure I understand it:
Let a and be be two strings of block length one. Suppose the sender sends $(a, \text{CBC-MAC}(a)), (b, \text{CBC-...
- 173
3
votes
2
answers
4k
views
AES key equal to IV (CBC mode)
Application uses AES in CBC mode with 128 bit key. In this implementation key is always same and is equal to IV.
Can attacker get the key or decrypt data? If he knows:
First and second blocks of ...
- 39
2
votes
1
answer
1k
views
Attacking CBC with predictable but encrypted IV
Let P be a secure block cipher, eg AES-128.
Let's say a server has a CBC encryption oracle which uses an attacker-selected yet unique nonce to generate the IV for each message = P(key, nonce). The ...
- 428
2
votes
2
answers
855
views
IV Security Clarification
After doing lots of reading on SO and other websites relating to AES cryptography, I am trying to understand the security issues surrounding IV's.
There seems to be a lot of confusion and ...
- 89
28
votes
6
answers
5k
views
Why not authenticate full-disk encryption?
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
- 383
20
votes
2
answers
8k
views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
- 24.8k
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
- 2,601
13
votes
3
answers
4k
views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
- 233
11
votes
3
answers
5k
views
Relative merits of AES ECB and CBC modes for securing data at rest
I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.
I assume the ...
10
votes
1
answer
8k
views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
9
votes
1
answer
11k
views
Error propagation in CBC mode
Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
- 861
7
votes
3
answers
1k
views
Why is a MAC needed with CBC?
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.
The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
- 1,778
6
votes
1
answer
2k
views
What are the constraints for an IV using AES in CBC mode?
I'm designing a protocol for use into a VPN software.
The VPN frames are encapsulated into AES-256 CBC encrypted frames. I understand that IVs must be uniquely used for each message encrypted with ...
- 161
6
votes
3
answers
6k
views
Why does CBC decryption with a wrong IV still give readable results?
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.
My encryption was correct. I was generating a random IV block and writing ...
- 295
5
votes
1
answer
832
views
Implementing 5 modes of operation with a hash function
Is it possible to implement any of the 5 modes of operation (ECB, CBC, OFB, CFB, CTR) with a hash function?
- 53
5
votes
3
answers
1k
views
Does the XML Encryption flaw affect SSL/TLS?
A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated:
XML Encryption Flaw Leaves Web Services Vulnerable.
Does this weakness of CBC-mode which is used here also ...
- 153
3
votes
1
answer
4k
views
Can AES in CBC mode be parallelized?
Is there any way to parallelize AES running in CBC mode? (The plan is to parallelize it using OpenMP)
- 323
3
votes
1
answer
628
views
How does padding oracle attack work with bytes larger than possible length?
I am trying to understand how the POODLE attack would actually be implemented. In the original security advisory from Möller, Duong and Kotowicz [POODLE 14] the following example is presented:
Assume ...
- 33
3
votes
1
answer
236
views
Is This method of generating Initialisation Vector for Cipher Block Chaining secure?
I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary:
In ...
- 131