Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

39 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
4 votes
0 answers
385 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
Robert Schaffar-Taurok's user avatar
4 votes
0 answers
207 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
SEJPM's user avatar
  • 46.1k
2 votes
0 answers
60 views

Is it possible to craft a valid AES-CBC cipher-text that will decrypt (to random) with any possible key?

I am mainly looking to perform this trick for fun. I have access to an API that uses WebCrypto under the hood for encrypt and ...
cmdruid's user avatar
  • 21
2 votes
0 answers
84 views

Exploit 3DES-CBC with known checksum of plaintext and repeated IV

I came across the following enterprise encryption scheme. I laughed when I first saw it, but I'm not a specialist and I'd like to know how bad it really is. 3DES-CBC k1=k2=k3 for 3DES IV for CBC is ...
j123b567's user avatar
  • 121
2 votes
1 answer
232 views

Which encryption technique should be adopted to keep the search functionalities?

I am in exactly the same situation as described in this post. I must be able to encrypt data from a client workstation then send it to an untrusted server (encrypted at rest), then decrypt it only on ...
Marc Alves's user avatar
2 votes
0 answers
434 views

An exercise to show that CBC Chain is insecure

The CBC-Chain mode of operation is a CBC variant in which the IV that is used for the very first message to be encrypted is randomly selected, whereas the IV used for each subsequent encrypted message ...
Sayantan's user avatar
2 votes
0 answers
241 views

Decrypting first byte of plain-text for AES CBC Padding Oracle Attack

I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm ...
Alex's user avatar
  • 341
2 votes
0 answers
42 views

Looking for a way to enlarge a message so that any modification to the "enlarged" message makes recovering the original message impossible

Let's say we have a message m of small size. I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...
MATHIEU SERAPHIM's user avatar
2 votes
0 answers
89 views

Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?

Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
jschw's user avatar
  • 121
2 votes
0 answers
723 views

TLS padding format

My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3 I came across the PKCS7 format for the padding: ...
mpgn's user avatar
  • 121
2 votes
0 answers
89 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
deft_code's user avatar
  • 220
2 votes
0 answers
514 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
Charlie Parker's user avatar
1 vote
0 answers
58 views

Security of modified CBC$ mode encryption

I am trying to understand the (IND-CPA or lack thereof) security of a modified CBC mode. Instead of choosing the IV completely at random per plaintext, the adversary provides a "pre-IV" ...
puppet puppet's user avatar
1 vote
0 answers
148 views

AES-CBC-MAC forgery attack

I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is ...
MSCHA's user avatar
  • 11
1 vote
0 answers
84 views

What would be the consequences of using a IV smaller than the block size in CBC encryption?

Here I use a Threefish kernel module with CBC mode. But there is no hash function that can supply a IV with Threefish block size (1024-bits), so I use a 64-bit random IV inserted in the dm-crypt with ...
phantomcraft's user avatar
1 vote
0 answers
78 views

Where exactly do you add the zeroes to a URL in a padding oracle attack? Also, how would you decrypt a file this way?

I have been studying various crypto attacks, and one of the attacks that I have recently studied was the padding oracle attack. Now, I mostly understand it, but there is one aspect of the padding ...
Rikudou's user avatar
  • 13
1 vote
0 answers
76 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
questioner's user avatar
1 vote
0 answers
133 views

Formal security arguments for 3 round feistal network using PRF

There is a proof sketch in Introduction to modern cryptography that a three-round feistel network using pseudorandom round functions is a secure pseudorandom permutation PRP Πk against probabilistic ...
Chulbuli's user avatar
1 vote
0 answers
129 views

Proving Security of a Tweakable Block Cipher in CBC Mode (Threefish)

I want to prove the security of a Tweakable Block Cipher in CBC Mode How does one prove the security of a Tweakable block cipher (ie Threefish) in CBC mode with a random IV and a constant (public) ...
Ant.Ger's user avatar
  • 31
1 vote
0 answers
317 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
Ben's user avatar
  • 11
1 vote
0 answers
1k views

CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
Sara's user avatar
  • 11
1 vote
0 answers
48 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
Parthian Shot's user avatar
0 votes
0 answers
150 views

CBC Predictable IV Help

I have this problem where I need to guess if bob wrote "yes" or "no" It is using AES-128-CBC and it tells me the next IV to be used. it takes input as a hex string and does the ...
drift's user avatar
  • 1
0 votes
0 answers
1k views

AES CBC - Find IV (CTF)

I am currently trying to solve a training challenge based on AES with CBC. This is the infos I'm given: ...
Shark44's user avatar
  • 145
0 votes
0 answers
298 views

Decryption failure for NIST vector AES-CBC-128

I am learning/exploring the openssl library for encrypting and decrypting data while encryption goes through fine I see standalone decryption not working as I expected. The test vector I am using is <...
Eddy's user avatar
  • 1
0 votes
0 answers
120 views

Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?

I know this is theoretically bad practice, but please bear with me… Assuming following spec: Salt and IV are randomly generated using cryptographically-secure RNG. Argon2 is used as KDF so ...
sunknudsen's user avatar
0 votes
0 answers
161 views

what will be the impact of a 2-bit error in a ciphertext block for decryption if AES is used in ECB, CBC and CTR mode?

So I was reading about 1-bit error propagation for AES mode and how it propagates in various modes. I was wondering how error would propagate in ECB, CBC and CTR modes if it was a 2-bit or a 3-bit ...
user0623's user avatar
0 votes
0 answers
330 views

Is it more secure to use Diffie-Hellman to generate a symmetric AES key for use with CBC, rather than use CBC directly atop RSA encryption?

Short question: If we assume a one-session use public RSA keypair on both sides, and if we assume that the input stream will be split into blocks -- with CBC encryption -- is there any security ...
quinthar's user avatar
  • 113
0 votes
0 answers
314 views

Is ECB mode more suitable than CBC mode while encrypting a long bit string?

I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
Sophie Elku's user avatar
0 votes
0 answers
516 views

Known plaintext attack on AES with CBC

Assume I have a plaintext and a ciphertext, encrypted using some key and AES with CBC mode. I don't have a service, that I can send something to, so I can't use the Padding Oracle attack. Are there ...
Anegng's user avatar
  • 1
0 votes
0 answers
158 views

Can I and How Decrypt this Online

Although I had a security course in school a long time ago, I am effectively new to cryptography. I have an encrypted text, the encryption key of 44 characters, the encryption method, (Fernet, which ...
Chozang's user avatar
  • 101
0 votes
0 answers
183 views

Decrypting an AES string

I'm dealing with a website that loads a javascript file which eventually sets an AES hash/value (whatever it's called) as a cookie. The file is heavily obfuscated making it hard to understand certain ...
Joe's user avatar
  • 1
0 votes
0 answers
230 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
user424241's user avatar
0 votes
0 answers
34 views

Are there any specific weakness in this crypto implementation?

I am reverse engineering the firmware of a particular router/modem. I am focusing on the functionality to export the router configuration. I an searching for a way to decrypt the configuration backup ...
Rocco Mancin's user avatar
0 votes
0 answers
105 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
Dario Blair's user avatar
0 votes
0 answers
309 views

How to change the known ciphertext so the known plaintext is changed in AES CBC mode?

I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out. So I have the encrypted cookie (AES_CBC): ...
Loeli's user avatar
  • 121
0 votes
0 answers
221 views

NRPAD and FPAD padding schemes (Korean Seed?)

I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding ...
Maarten Bodewes's user avatar
  • 92.9k
-1 votes
1 answer
91 views

Given and encrypted message, is it theoretically possible to decrypt a message without the key or guessing it? If so, what methods could be used?

Decrypting an AES-Encrypted Message Without the Key: A Cryptographic Challenge Summary: I am investigating the possibility of decrypting an AES-encrypted message when the encryption key is unknown ...
NeoX's user avatar
  • 1