Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
488
questions
91
votes
2
answers
170k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,273
83
votes
9
answers
137k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
47
votes
2
answers
75k
views
AES CBC mode or AES CTR mode recommended?
What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
- 1,031
39
votes
3
answers
10k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,415
39
votes
3
answers
47k
views
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
I just learned that using CBC encryption with an IV which is predictable is not secure.
From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
- 491
37
votes
2
answers
13k
views
Why should I use an Initialization Vector (IV) when I have unique keys?
I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same.
I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
- 473
36
votes
1
answer
49k
views
What is the advantage of XTS over CBC mode (with diffuser)?
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
- 463
33
votes
2
answers
11k
views
7zip : Why does encrypting the same file with AES-256 not give the same output?
Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
- 463
28
votes
6
answers
5k
views
Why not authenticate full-disk encryption?
Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
- 383
24
votes
3
answers
38k
views
How can Cipher Block Chaining (CBC) in SSL be attacked?
I am trying to understand how CBC-mode in SSL/TLS can be attacked.
I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
- 341
22
votes
5
answers
9k
views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
- 415
21
votes
3
answers
22k
views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
- 530
20
votes
4
answers
21k
views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is it?...
- 365
20
votes
2
answers
8k
views
Why do new versions of TLS use an explicit IV for CBC suites?
SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
- 24.8k
19
votes
3
answers
11k
views
Modes of operation that allow padding oracle attacks
It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why?
...
- 91.7k
17
votes
1
answer
26k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 311
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
- 2,601
15
votes
2
answers
2k
views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
- 315
15
votes
2
answers
8k
views
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
- 581
14
votes
1
answer
9k
views
Reusing keys with AES-CBC
I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC.
Is reusing the same key several ...
- 523
13
votes
3
answers
15k
views
Difference between a nonce and IV
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
- 861
13
votes
3
answers
4k
views
Is it okay to use a hash of a timestamp as the IV for AES?
The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector?
In this case, CBC is the mode being used.
- 233
11
votes
2
answers
2k
views
Random data CBC padding scheme?
When using AES in CBC mode, padding is required when the last plaintext block has not the length required by the cipher. Let's say $k$ mode bytes would be required to fill the block. My idea was to ...
- 233
11
votes
3
answers
5k
views
Relative merits of AES ECB and CBC modes for securing data at rest
I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data.
I assume the ...
11
votes
2
answers
22k
views
How exactly does AES-NI work?
I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI ...
- 471
11
votes
0
answers
2k
views
Why does the Signal protocol use AES/CBC instead of AES/GCM?
AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
- 324
10
votes
4
answers
5k
views
Are there any benefits to using ECB over CBC?
From what I have understood about ECB and CBC, CBC is far better as it doesn't reveal any pattern. There have been several questions here about how ECB is bad:
Should I use ECB or CBC encryption mode ...
- 203
10
votes
3
answers
7k
views
Malleability attacks against encryption without authentication
Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block:
...
- 1,486
10
votes
1
answer
8k
views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
10
votes
1
answer
3k
views
CBC-Mode Infinite Garble Extension
A variation of the CBC mode is the Infinite Garble Extension.
I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
- 393
10
votes
3
answers
13k
views
How to break AES/CBC/PKCS5 when key and IV are reused?
I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
- 101
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
- 45.9k
9
votes
4
answers
7k
views
Security proofs for CBC mode
I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
- 2,837
9
votes
1
answer
11k
views
Error propagation in CBC mode
Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
- 861
9
votes
3
answers
30k
views
Best way to generate a IV for AES-CBC when encrypting files?
The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored ...
- 193
9
votes
1
answer
14k
views
How do I correctly derive a Key and IV?
Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class).
This encryption code will be used in conjunction with existing ...
- 193
9
votes
2
answers
1k
views
Is the 64-bit blocksize a fatal issue when encrypting TBs of data with Blowfish CBC?
Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the password,...
- 91
9
votes
1
answer
1k
views
CBC key lifetime, or, "how big is too big?"
IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB.
My case isn't using IPSec, ...
- 93
9
votes
1
answer
9k
views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
- 1,001
8
votes
2
answers
1k
views
Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode
I was not able to understand why we practically need a CPA security in Cipher Block Chaining, which insist on having a random IV. Let's say if the encryption is not CPA secure, i.e. the adversary can ...
- 443
8
votes
1
answer
360
views
Predictable, but private IV in CBC
It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
- 81
8
votes
1
answer
3k
views
Importance of block size in CBC mode
Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
- 83
8
votes
2
answers
2k
views
CBC variant: why encrypt the nonce with a different key?
I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
- 81
8
votes
1
answer
2k
views
Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?
Reading Password Interception in a SSL/TLS Channel that was released in 2003:
At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
- 1,535
8
votes
1
answer
1k
views
An example of an appropriate use case for AES-CBC encryption without authentication?
I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community.
Recently in this question AES in CBC Mode Is totally unsecure if ...
- 329
8
votes
1
answer
8k
views
POODLE attack on TLS 1.2
The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value.
From what I understand, even TLS 1.1 can be vulnerable (...
- 279
7
votes
1
answer
49k
views
Why is padding used in CBC mode?
I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
- 253
7
votes
3
answers
1k
views
Why is a MAC needed with CBC?
I agree that for certain encryption systems or modes of operation, a MAC is indispensible.
The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
- 1,778
7
votes
2
answers
7k
views
How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?
Given a CBC ciphertext and IV, how can I find the encryption key?
We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
antisane
7
votes
3
answers
5k
views
What is DES-EDE3-CBC?
I came across DES-EDE3-CBC and a quick search didn't yield a clear explanation of what it is.
Clearly, DES is the Data Encryption Standard and CBC is the Cipher Block Chaining mode.
EDE is probably ...
- 253