Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
489
questions
0
votes
0
answers
3
views
Rate the security of the following MAC encryption
Ok we know if the IV becomes predictable, then our encryption scheme becomes vulnerable to chosen plaintext attacks.
but what if we XOR at the last step a new IV2
Can you evaluate the security of ...
- 1
0
votes
1
answer
75
views
CBC KEY recovery when KEY=IV
We have access to an encryption and decryption server with the following implementation. How can we get the secret key by interacting with this server?
...
- 3
0
votes
0
answers
126
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
1
vote
1
answer
99
views
Is the Bit Flipping attack on CBC mode possible if the IV is not know to the attacker?
This is a follow up question to:
Bit Flipping Attack on CBC Mode
which demonstrates that a bit flipping attack with a known IV is possible on CBC mode.
Is it safe to assume that the bit flicking ...
user112328
2
votes
1
answer
143
views
Does using a block cipher in CBC mode *twice* result in an all-or-nothing transform (AONT)?
Use a block cipher in CBC mode with a public or all-0 key. Twice.
Wrapping the last block into (xor) the first on the second round.
Every block will depend on all previous and all successive blocks. ...
3
votes
1
answer
56
views
how 0/n split prevent BEAST attack against TLS?
I read that to mitigrate BEAST attack openSSL tried to inject empty TLS record before each real TLS record. and by doing that there is no opportunity to execute an attack but i dont understand way?
...
- 31
0
votes
1
answer
69
views
How to get the rest of 10 bytes (from total 32 bytes plaintext) of plaintext from a 48 byte ciphertext using AES-128 when knowing 22B of plaintext?
I have a challenge in which I need to decrypt 32(?) bytes of plaintext, which by encryption resulted in 48 (this for sure) bytes of data.
It's a black box challenge, but managed to figure out the ...
- 173
0
votes
1
answer
46
views
Key expansion in AES CTR mode
While working with AES 256 in CBC mode, I learned that it requires Key Expansion - forward (for encryption) and reverse (for decryption).
Does AES CTR mode also requires such a step ? Or can the 256 ...
- 103
0
votes
0
answers
527
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
2
votes
0
answers
49
views
Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?
I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
- 21
1
vote
1
answer
343
views
CBC not CCA secure
I always get stuck at those kind of exercises in my Cryptography class. I just don't understand how should I build these scenarios of "sending m1 and m2 and then somehow telling if it was m1 or ...
- 19
2
votes
1
answer
328
views
Padding Oracle Attack Example
I try to understand a oracle Padding Oracle Attack example. I try to solve this question but I didn't figure out the answer.
A 7-byte message is padded per PKCS#5 and encrypted using the CBC mode of ...
- 31
1
vote
1
answer
76
views
Cryptography particular block length valid message
I am new at cryptography and start to learn some terms. I just saw an question in the book and didn't got a clue about this question. Could someone can explain me the answer of this question? Because ...
- 31
2
votes
1
answer
492
views
Padding Oracle Attack - Decrypting First Block with Static IV
I'm trying to understand the exploitability of the padding oracle attack, which enables someone to decrypt and encrypt the contents without knowing the encryption key.
Can encrypted data with the ...
- 23
2
votes
0
answers
48
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
1
vote
2
answers
140
views
Role of IV in Perl's Crypt::Rijndael
Sorry in advance if I'm asking a stupid question:
I thought the role of "IV" in encryption is to avoid having identical ciphertext for identical plaintext.
So one could use some random IV.
...
- 163
3
votes
1
answer
85
views
GCM-SIV vs CBC with fixed IV?
I keep hearing CBC with fixed IV mode is bad because it has similar issues to the codebook breakdown of ECB mode. However, people seem quite willing to recommend AES-GCM-SIV for deterministic ...
- 31
0
votes
1
answer
417
views
How to encrypt with CBC, step by step?
I have this message "Hello from another world"
Can you explain how to encrypt it with CBC step by step?
Are the message characters ...
-1
votes
1
answer
129
views
How is DES used with CBC?
I'm reading our school's notes for cryptography, and it does a good job explaining CBC and DES in detail, but it fails to provide good information on how they are related.
From what I've researched so ...
6
votes
2
answers
1k
views
Always set the IV to 0 randomized CBC
Please explain what goes wrong if we always set the IV to 0 in randomized CBC, and use the system to encrypt two different messages m0 /= m1 with the same key k.
I ...
- 185
1
vote
0
answers
159
views
AES-CBC collision resistance of hash function [closed]
I'm very new to cryptography and am having some issues with the following question
...
- 11
1
vote
0
answers
124
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
1
answer
187
views
Is it normal that cypertext size can be smaller than IV when using AES-256-GCM?
I noticed that when using AES-256-CBC with a 128-bit IV, the ciphertext is always at least 16 bytes long (size of IV).
I also noticed that when using AES-256-GCM with a 96-bit IV, the ciphertext size ...
- 189
0
votes
0
answers
52
views
CBC Operation with Known IV [duplicate]
I am trying to understand how XOR operation can lead us to know the plaintext if we can predict the iv using the chosen plaintext attack game.
- 161
0
votes
1
answer
1k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
- 161
0
votes
0
answers
287
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
2
votes
1
answer
150
views
what is IV predictable?
What is IV predictable in the CBC mode?
We only need one IV once for CBC mode, does the IV-predictable means we know the initialization vector before we start a CBC mode? Or it means we know each ...
- 23
1
vote
1
answer
79
views
Can one infer concatenated ciphertext block boundaries through digital forensics?
Say one encrypts multiple plain text blocks with same IV but different keys using AES-256-CBC, can one infer concatenated ciphertext block boundaries through digital forensics?
Example
Plain text ...
- 189
3
votes
3
answers
4k
views
Is there a security risk to use AES-CBC as stream cipher?
I am building a chat application where I want to encrypt each character while they are typing. I would require a stream cipher for that.
I am planning to use AES-CBC mode with HMAC. Are there any ...
- 257
0
votes
0
answers
107
views
Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?
I know this is theoretically bad practice, but please bear with me…
Assuming following spec:
Salt and IV are randomly generated using cryptographically-secure RNG.
Argon2 is used as KDF so ...
- 189
7
votes
3
answers
5k
views
What is DES-EDE3-CBC?
I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is.
Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode.
EDE is probably ...
- 253
1
vote
1
answer
70
views
How does a GMAC in GCM not nullify the utility of a seekable decrypt-able stream
I have been looking at the Galois/Counter Mode (GCM) for stream encryption. I understand the idea that it's a stream cipher and so it can be encrypted one bit at a time by XORing with the key stream ...
- 113
2
votes
2
answers
591
views
What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?
I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03.
According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
- 21
3
votes
2
answers
293
views
Is disabling padding integrity check in CBC implementations a good way of overcoming / mitigating padding oracle attack?
Given that CBC mode has a padding oracle attack, would disabling the padding integrity check be a good way of overcoming the vulnerability (this may result in frustration among existing users with ...
- 204
2
votes
2
answers
257
views
AES CBC: When to use new IV
I am trying to figure out when to use a new IV for an AES-CBC communication and whether my approach is safe.
Here is a quote from Thomas Pornin from a similar question:
So, to sum up: you must choose ...
- 165
0
votes
1
answer
552
views
Alternative to CBC mode encryption?
Given that CBC mode encryption is vulnerable to padding oracle attacks, what is the next best alternative ?
a) Include a hash check in the API scheme, validate the hash and then proceed with CBC. If ...
- 204
1
vote
0
answers
68
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 877
1
vote
0
answers
59
views
Can I decrypt AES-CBC ciphertext if I have the key without IV? [duplicate]
Can I decrypt ciphertext from AES-CBC encryption, if I have the key and ciphertext only?
- 17
2
votes
2
answers
1k
views
AES output lengths are not always a multiple of 16
I have a C# solution that encrypts a bunch of small data chunks using AES.
...
- 121
2
votes
2
answers
563
views
Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 vulnerable to Zombie POODLE/GOLDENDOODLE attacks?
I'm getting mixed reports on this one. I have a web host and multiple SSL scanning tools (including the one run by Qualsys SSL Labs), saying that the cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ...
- 121
0
votes
0
answers
153
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
1
vote
2
answers
1k
views
Is it possible to find an AES key given part of the key, the ciphertext, initialization vector and mode of encryption?
The following details are given:
Partial Key: ...
- 21
0
votes
1
answer
154
views
Is it possible to perform CPA attack against CBC changing IV by last ciphertext block?
I was trying to do a simple CPA attack against this scheme, to understand better the concept.
Instead of using a new 𝐼𝑉 each time, we decide to use the last block
of the previous ciphertext as an ...
0
votes
0
answers
28
views
CBC byte flipping attack [duplicate]
I'm learning how CBC works but i don't understand when altering the first 2 bytes of the ciphered text why the 1rst block and ONLY the first 2 bytes of the second block are altered. The first 2 bytes ...
3
votes
1
answer
1k
views
Can you use RSA in “CBC mode”?
Are there any security concerns with using RSA in “CBC mode”?
Specifically: if I use RSA encryption as my block cipher operation, and apply the standard CBC mode operations including a random IV, will ...
0
votes
1
answer
198
views
Is multiple encryption using CBC mode of operation susceptible to Meet-in-the-middle attacks?
I read it once on a page (I don't remember the link and I coundn't find it) that said about a cascade of AES with two 256-bits keys and that it provides 384-bits of security. Maybe not 512-bits of ...
- 877
0
votes
1
answer
282
views
Is CBC mode of encryption still safe as long as it's not use to send messages over a network?
I'm still reading about the Padding Oracle attack and Side Channel attack that can be performed to decrypt cipher text encrypted with CBC though it's still not clear to me.
But base on my little ...
- 105
1
vote
2
answers
344
views
changing messages for authentication without the tag changed. (CBC-MAC)
do you know about CBC-MAC? I have iv ,MAC and Transaction but no key. and I should change Transaction without change cipher text. do you know how this is possible at all? In addition, I do not have ...
- 21
2
votes
2
answers
1k
views
Why bother to generate Key, IV and encrypt them?
When we perform encryption with Public or Private Key, Asymmetric AES with RSA and CBC 128, and when we use the padding as well. Why do we have to bother adding the additional:
Key + IV?
...
John Smith
2
votes
2
answers
936
views
Distinguishing the correct IV from incorrect IV in AES CBC when key is known
Currently, I'm using a static IV value for all encryption and decryption but I would like it to be dynamic for each encyption/decryption request so I started using new byte[16] and it works. The ...
