Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

22 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
0answers
840 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
4
votes
0answers
239 views

AES key reuse between CTR and CBC

The question Given the same plaintext content that is encrypted two times. One time with AES-CTR and the other time with AES-CBC. Both times with the same AES key but with different IVs. What are ...
4
votes
0answers
156 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
3
votes
0answers
464 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
2
votes
0answers
42 views

Decrypting first byte of plain-text for AES CBC Padding Oracle Attack

I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm ...
2
votes
0answers
35 views

Looking for a way to enlarge a message so that any modification to the “enlarged” message makes recovering the original message impossible

Let's say we have a message m of small size. I am looking for a system $S$ so that $S(m)$ is arbitrarily large, we can easily compute the inverse $I(S(m)) = m$, and any modification to $S(m)$ makes it ...
2
votes
0answers
47 views

Is it okay to have no IV when using AES-CBC with unique keys, that are however derived from one shared key?

Given $\operatorname{AES-CBC}$ (128-bit), with $IV=0$ and unique encryption keys $$K_{Enc} = \operatorname{CMAC}(MK, \text{known_text})$$ where $MK$ is a shared symmetric 128-bit key and $\text{...
2
votes
0answers
651 views

TLS padding format

My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3 I came across the PKCS7 format for the padding: ...
2
votes
0answers
89 views

Cracking an appliance's network protocol

I'm trying to crack my thermostat's network protocol. I've captured several rounds of network traffic and here is what I've got to work with. Communicating via HTTP POST The POST data is JSON ...
1
vote
0answers
22 views

CBC-MAC variable-length weakness with MAC size greater than the encryption block size

The title mostly explains it; CBC-MAC variable-length weakness with MAC size greater than the encryption block size I've seen that by having the pairs $(M,T_m)$ and $(N,T_n)$, we can generate a ...
1
vote
0answers
852 views

CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
1
vote
0answers
43 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
0
votes
0answers
51 views

Can I and How Decrypt this Online

Although I had a security course in school a long time ago, I am effectively new to cryptography. I have an encrypted text, the encryption key of 44 characters, the encryption method, (Fernet, which ...
0
votes
0answers
58 views

Decrypting an AES string

I'm dealing with a website that loads a javascript file which eventually sets an AES hash/value (whatever it's called) as a cookie. The file is heavily obfuscated making it hard to understand certain ...
0
votes
0answers
22 views

OPA attack with IV || ciphertext1 || ciphertext2

I know this is a kind of a very un-specific question. But I cannot figure it out where I am doing it wrong implementing an Oracle Padding attack. So What I'm supposed to do is to send a iv || ...
0
votes
0answers
79 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
0
votes
0answers
22 views

Are there any specific weakness in this crypto implementation?

I am reverse engineering the firmware of a particular router/modem. I am focusing on the functionality to export the router configuration. I an searching for a way to decrypt the configuration backup ...
0
votes
0answers
58 views

Meet-in-the-middle attack (different block cipher modes)

Does a meet-in-the-middle attack on depend on the used modes for block ciphers? encryption: $C_i$ = $D_{K2}$($D_{K1}$($E_{K1}$($P_i$ $\oplus$ $C''_{i-1}$))) $\oplus$ $C'_{i-1}$ and $IV_1$ = $C''_0$ = ...
0
votes
0answers
109 views

How to change the known ciphertext so the known plaintext is changed in AES CBC mode?

I already read a blog about the padding oracle and also some posts about how to change the plaintext but it didn't work out. So I have the encrypted cookie (AES_CBC): ...
0
votes
0answers
182 views

NRPAD and FPAD padding schemes (Korean Seed?)

I've got an API spec that specifies NRPAD and FPAD as possible padding schemes. I see these being used together with the Korean SEED algorithm. The SEED specification however is void of any padding ...
-1
votes
0answers
31 views

Finding Collisions on CBC-MAC with known IV and key

Given a message $m$ which is encrypted using a known IV and known key in CBC mode which gives MAC $t$ which is 20 bytes. How can we create a message $m'$ which produces the same MAC $t$? Using the ...
-2
votes
0answers
159 views

Hypothetical AES CBC hash function collision resistant?

If we consider a hypothetical hash function H defined by AES-CBC where it encrypts n-blocks (C1,C2,C3..Cn) and the hash value is the last cipher text block - Cn. IV and Key are predefined values ...