Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
37
questions with no upvoted or accepted answers
11
votes
0
answers
2k
views
Why does the Signal protocol use AES/CBC instead of AES/GCM?
AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
- 324
4
votes
0
answers
367
views
AES key reuse between CTR and CBC
The question
Given the same plaintext content that is encrypted two times.
One time with AES-CTR and the other time with AES-CBC.
Both times with the same AES key but with different IVs.
What are ...
4
votes
0
answers
206
views
Does length prepending fix the key reuse problems with CBC and CBC-MAC?
As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.
Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
- 45.7k
2
votes
0
answers
49
views
Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?
I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
- 21
2
votes
0
answers
48
views
Exploit 3DES-CBC with known checksum of plaintext and repeated IV
I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is.
3DES-CBC
k1=k2=k3 for 3DES
IV for CBC is ...
- 121
2
votes
1
answer
208
views
Which encryption technique should be adopted to keep the search functionalities?
I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
- 21
2
votes
0
answers
388
views
An exercise to show that CBC Chain is insecure
The CBC-Chain mode of operation is a CBC variant in which the IV that is used for
the very first message to be encrypted is randomly selected, whereas the IV used for
each subsequent encrypted message ...
- 41
2
votes
0
answers
216
views
Decrypting first byte of plain-text for AES CBC Padding Oracle Attack
I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm ...
- 321
2
votes
0
answers
42
views
Looking for a way to enlarge a message so that any modification to the "enlarged" message makes recovering the original message impossible
Let's say we have a message m of small size.
I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...
2
votes
0
answers
83
views
Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?
Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
- 121
2
votes
0
answers
717
views
TLS padding format
My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3
I came across the PKCS7 format for the padding:
...
- 121
2
votes
0
answers
89
views
Cracking an appliance's network protocol
I'm trying to crack my thermostat's network protocol.
I've captured several rounds of network traffic and here is what I've got to work with.
Communicating via HTTP POST
The POST data is JSON ...
- 220
2
votes
0
answers
509
views
Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
- 265
1
vote
0
answers
124
views
AES-CBC-MAC forgery attack
I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
- 11
1
vote
0
answers
68
views
What would be the consequences of using a IV smaller than the block size in CBC encryption?
Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
- 877
1
vote
0
answers
64
views
Where exactly do you add the zeroes to a URL in a padding oracle attack? Also, how would you decrypt a file this way?
I have been studying various crypto attacks, and one of the attacks that I have recently studied was the padding oracle attack. Now, I mostly understand it, but there is one aspect of the padding ...
- 13
1
vote
0
answers
72
views
CTR mode calculate messages before new key is required
I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR).
I have just two simple questions:
At around 4:30 in the video they show 2^48 without saying where ...
- 145
1
vote
0
answers
126
views
Formal security arguments for 3 round feistal network using PRF
There is a proof sketch in Introduction to modern cryptography that a three-round feistel network using pseudorandom round functions is a secure pseudorandom permutation PRP Πk against probabilistic ...
- 11
1
vote
0
answers
124
views
Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)
I want to prove the security of a Tweakable Block Cipher in CBC Mode
How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
- 31
1
vote
0
answers
279
views
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
The title mostly explains it;
CBC-MAC variable-length weakness with MAC size greater than the encryption block size
I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
- 11
1
vote
0
answers
1k
views
CBC mode is not IND-CCA2 secure with no prediction of IV
How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary.
Edit:
In decryption of CBC, for each block it is XORed with previous block's cipher ...
- 11
1
vote
0
answers
46
views
Which protocols / file formats use CBC with a random IV and without a MAC?
Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here.
The ...
- 111
0
votes
0
answers
126
views
CBC Predictable IV Help
I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
- 1
0
votes
0
answers
527
views
AES CBC - Find IV (CTF)
I am currently trying to solve a training challenge based on AES with CBC.
This is the infos I'm given:
...
- 145
0
votes
0
answers
287
views
Decryption failure for NIST vector AES-CBC-128
I am learning/exploring the openssl library for encrypting and decrypting data
while encryption goes through fine I see standalone decryption not working as I expected.
The test vector I am using is
<...
- 1
0
votes
0
answers
107
views
Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?
I know this is theoretically bad practice, but please bear with me…
Assuming following spec:
Salt and IV are randomly generated using cryptographically-secure RNG.
Argon2 is used as KDF so ...
- 189
0
votes
0
answers
153
views
what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?
So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
- 1
0
votes
0
answers
319
views
Is it more secure to use Diffie-Hellman to generate a symmetric AES key for use with CBC, rather than use CBC directly atop RSA encryption?
Short question:
If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security ...
- 113
0
votes
0
answers
313
views
Is ECB mode more suitable than CBC mode while encrypting a long bit string?
I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
0
votes
0
answers
431
views
Known plaintext attack on AES with CBC
Assume I have a plaintext and a ciphertext, encrypted using some key and AES with CBC mode. I don't have a service, that I can send something to, so I can't use the Padding Oracle attack. Are there ...
- 1
0
votes
0
answers
150
views
Can I and How Decrypt this Online
Although I had a security course in school a long time ago, I am effectively new to cryptography.
I have an encrypted text, the encryption key of 44 characters, the encryption method, (Fernet, which ...
- 101
0
votes
0
answers
145
views
Decrypting an AES string
I'm dealing with a website that loads a javascript file which eventually sets an AES hash/value (whatever it's called) as a cookie. The file is heavily obfuscated making it hard to understand certain ...
- 1
0
votes
0
answers
222
views
Another cut-and-paste attack on CBC mode
I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
- 131
0
votes
0
answers
33
views
Are there any specific weakness in this crypto implementation?
I am reverse engineering the firmware of a particular router/modem.
I am focusing on the functionality to export the router configuration.
I an searching for a way to decrypt the configuration backup ...
0
votes
0
answers
101
views
Meet-in-the-middle attack (different block cipher modes)
Does a meet-in-the-middle attack on depend on the used modes for block ciphers?
encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
- 31
0
votes
0
answers
280
views
How to change the known ciphertext so the known plaintext is changed in AES CBC mode?
I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out.
So I have the encrypted cookie (AES_CBC):
...
- 111
0
votes
0
answers
215
views
NRPAD and FPAD padding schemes (Korean Seed?)
I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding ...
- 91.9k