Skip to main content

Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

Filter by
Sorted by
Tagged with
92 votes
2 answers
174k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
Bob Bryan's user avatar
  • 1,283
83 votes
9 answers
138k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
midhunhk's user avatar
  • 1,151
47 votes
2 answers
79k views

AES CBC mode or AES CTR mode recommended?

What are the benefits and disadvantages of CBC vs. CTR mode? Which one is more secure?
mary's user avatar
  • 1,031
39 votes
3 answers
11k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
Richard R. Matthews's user avatar
39 votes
3 answers
48k views

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

I just learned that using CBC encryption with an IV which is predictable is not secure. From what I understand, using certain plain texts, and then guessing the IV that it uses, the attacker can ...
asudhak's user avatar
  • 491
37 votes
2 answers
14k views

Why should I use an Initialization Vector (IV) when I have unique keys?

I took a look at “Why, or when, to use an Initialization Vector?” but my question is not the same. I have unique keys encrypting each plaintext (in CBC mode, AES-256) and I do not use a key to ...
Ashwin's user avatar
  • 473
37 votes
1 answer
52k views

What is the advantage of XTS over CBC mode (with diffuser)?

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
tommynogger's user avatar
33 votes
2 answers
12k views

7zip : Why does encrypting the same file with AES-256 not give the same output?

Using 7-zip 19.00, on Windows 10 1909, build 18363.592, I encrypted a text file with the contents "hello there" using AES-256 and the password "123". I did this two times, the exact same procedure, ...
super's user avatar
  • 463
29 votes
6 answers
5k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
matejcik's user avatar
  • 393
24 votes
3 answers
39k views

How can Cipher Block Chaining (CBC) in SSL be attacked?

I am trying to understand how CBC-mode in SSL/TLS can be attacked. I have been looking around online but all examples and explanations are very hard to understand and follow. Can you give a simple ...
antonpug's user avatar
  • 341
22 votes
5 answers
9k views

Using CBC with a fixed IV and a random first plaintext block

What if, instead of using CBC mode in the normal way with a random IV, I used this approach: Use a fixed IV (like a block of 0's). Before encrypting, generate a random block and prepend it to the ...
danieltorres's user avatar
22 votes
3 answers
23k views

Is AES in CBC mode secure if a known and/or fixed IV is used?

I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
KeithS's user avatar
  • 540
21 votes
4 answers
23k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
Ben's user avatar
  • 375
20 votes
2 answers
9k views

Why do new versions of TLS use an explicit IV for CBC suites?

SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: they used the last part of the previous record, a value that can be predicted by the attacker. ...
CodesInChaos's user avatar
  • 24.9k
19 votes
3 answers
11k views

Modes of operation that allow padding oracle attacks

It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why? ...
Maarten Bodewes's user avatar
  • 93.3k
18 votes
1 answer
31k views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
CXB's user avatar
  • 321
15 votes
3 answers
2k views

Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?

The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes. Does this mean that an attacker can only see a single ...
makerofthings7's user avatar
15 votes
2 answers
2k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
Mike's user avatar
  • 315
15 votes
2 answers
8k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
izzle's user avatar
  • 591
14 votes
1 answer
10k views

Reusing keys with AES-CBC

I heard that key/IV pairs must not be reused in AES-CTR, or when using any stream cipher for that matter. Yet the attacks described do not seem to apply to AES-CBC. Is reusing the same key several ...
user2398029's user avatar
13 votes
3 answers
16k views

Difference between a nonce and IV

I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
user220201's user avatar
13 votes
3 answers
4k views

Is it okay to use a hash of a timestamp as the IV for AES?

The message format includes a datetime field in the clear. Is it okay to also use this field (or some hash thereof) as the initialization vector? In this case, CBC is the mode being used.
Ed Thomas's user avatar
  • 233
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
11 votes
2 answers
3k views

Random data CBC padding scheme?

When using AES in CBC mode, padding is required when the last plaintext block has not the length required by the cipher. Let's say $k$ mode bytes would be required to fill the block. My idea was to ...
HerpDerpington's user avatar
11 votes
3 answers
5k views

Relative merits of AES ECB and CBC modes for securing data at rest

I need to store several million Payment Card Numbers (PCNs) securely in a mainframe database (that is, 'at rest'). I assume that any attacker will have access to all of the stored data. I assume the ...
Brent.Longborough's user avatar
11 votes
2 answers
23k views

How exactly does AES-NI work?

I am looking in to AES-NI which is now supported by many new CPU's and I have read a few papers which states that AES-CBC works faster with AES-NI, but I am unable to understand how exactly AES-NI ...
rijndael's user avatar
  • 471
11 votes
1 answer
3k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
userkir's user avatar
  • 403
10 votes
4 answers
5k views

Are there any benefits to using ECB over CBC?

From what I have understood about ECB and CBC, CBC is far better as it doesn't reveal any pattern. There have been several questions here about how ECB is bad: Should I use ECB or CBC encryption mode ...
Kepotx's user avatar
  • 203
10 votes
3 answers
7k views

Malleability attacks against encryption without authentication

Suppose there is a message that is encrypted with AES-128-CBC. The message is as follows, new lines are used to delimit the 16 byte boundary for each block: ...
Rook's user avatar
  • 1,506
10 votes
1 answer
8k views

What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?

I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...
Vladislav Rastrusny's user avatar
10 votes
3 answers
14k views

How to break AES/CBC/PKCS5 when key and IV are reused?

I'm doing a code review for a crypto solution that reuses the same key with a constant IV. I want to demonstrate that this is not the right way to do things by figuring out the key and decrypting all ...
Heathkit7's user avatar
  • 101
10 votes
2 answers
3k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
Ilmari Karonen's user avatar
9 votes
4 answers
7k views

Security proofs for CBC mode

I'm looking for different approaches to proofs for the security of CBC mode encryption. What are the best sources of information about this subject?
Dingo13's user avatar
  • 2,867
9 votes
1 answer
11k views

Error propagation in CBC mode

Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
user220201's user avatar
9 votes
3 answers
33k views

Best way to generate a IV for AES-CBC when encrypting files?

The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored ...
Jordi's user avatar
  • 193
9 votes
1 answer
14k views

How do I correctly derive a Key and IV?

Mainly I'm trying to understand how to correctly create the Key and IV for use with the .NET Implementation of AES (AesManaged class). This encryption code will be used in conjunction with existing ...
John B's user avatar
  • 193
9 votes
2 answers
1k views

Is the 64-bit blocksize a fatal issue when encrypting TBs of data with Blowfish CBC?

Crashplan uses 448-bit Blowfish to encrypt the data you send them. The mode used is CBC, keys are multiple use, and IVs are generated with SecureRandom from JCE. Keys are not derived from the password,...
user7298's user avatar
9 votes
1 answer
2k views

CBC key lifetime, or, "how big is too big?"

IPSec recommends rekeying SA's figuring in both time and amount of data sent. Even when using AES-256 in CBC mode, the key and IV commonly get re-negotiated after 100MB. My case isn't using IPSec, ...
bmedward's user avatar
9 votes
1 answer
9k views

Why, or when, to use an Initialization Vector?

i'm trying to figure out when an Intialization Vector (IV) should be used. There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
Ian Boyd's user avatar
  • 1,001
8 votes
2 answers
2k views

Practical necessity of semantic security under chosen plain text attack (CPA) in CBC mode

I was not able to understand why we practically need a CPA security in Cipher Block Chaining, which insist on having a random IV. Let's say if the encryption is not CPA secure, i.e. the adversary can ...
David's user avatar
  • 443
8 votes
1 answer
367 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
Kethan's user avatar
  • 81
8 votes
1 answer
3k views

Importance of block size in CBC mode

Why is it necessary to use a sufficiently long block size when implementing a CBC block cipher with a truly random initialization vector? In ECB mode it's easy to get information about the message if ...
buildist's user avatar
8 votes
2 answers
3k views

Strength of CBC with Ciphertext Stealing

Is CBC with Ciphertext Stealing (CTS) considerably weaker than CBC with padding such as PKCS7? I would imagine the most common situation where CTS is necessary would be due to some size constraint of ...
Syon's user avatar
  • 183
8 votes
2 answers
2k views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
Maty's user avatar
  • 81
8 votes
1 answer
2k views

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

Reading Password Interception in a SSL/TLS Channel that was released in 2003: At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
David 天宇 Wong's user avatar
8 votes
1 answer
1k views

An example of an appropriate use case for AES-CBC encryption without authentication?

I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community. Recently in this question AES in CBC Mode Is totally unsecure if ...
RonC's user avatar
  • 329
8 votes
1 answer
8k views

POODLE attack on TLS 1.2

The POODLE attack uses the way block ciphers in CBC mode are decrypted in combination with the packet's padding to determine some byte's value. From what I understand, even TLS 1.1 can be vulnerable (...
Beurtschipper's user avatar
7 votes
1 answer
52k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
danny's user avatar
  • 253
7 votes
3 answers
1k views

Why is a MAC needed with CBC?

I agree that for certain encryption systems or modes of operation, a MAC is indispensible. The best example are probably stream ciphers (and therefore also block ciphers in OFB or CTR mode) that ...
lxgr's user avatar
  • 1,788
7 votes
2 answers
8k views

How can I do a brute force (ciphertext only) attack on an CBC-encrypted message?

Given a CBC ciphertext and IV, how can I find the encryption key? We are limited with an 8 chars key, each char in the range of [a..h], so I can generate every possible key (these are only $8^8 = 2^{...
user avatar

1
2 3 4 5
10