Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

Filter by
Sorted by
Tagged with
3
votes
1answer
155 views

Security proof for CBC as a prefix-free PRF

I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
1
vote
1answer
2k views

Security of AES counter mode vs. CBC mode

For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
0
votes
1answer
297 views

How to use CPA on AES128-CBC with constant Key and IV to leak info?

I'm doing a challenge in which I need to login to a server as an admin to capture a flag. I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters. The flow is as follows:...
7
votes
1answer
866 views

Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?

Reading Password Interception in a SSL/TLS Channel that was released in 2003: At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
0
votes
1answer
156 views

Is CBC still better than ECB if the key and a large part of the texts are random?

I am doing protection for my software, which involves storing a part of the crucial algorithm inside a smart-card based dongle. I will supply the input to the dongle, and I will expect the output of ...
2
votes
1answer
259 views

Attack on AES-CBC with small pool of IV

Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$. I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
5
votes
1answer
569 views

AES CBC with unique key per message, but fixed IV

I'm working on a project with a scheme in which c[i] = AES-CBC-Encrypt(msg_key[i], IV, msg[i]), and two distinct plaintexts never have identical keys. ...
0
votes
3answers
757 views

AES CBC mode is good for encrypting 15-20mb files and then sending it in parts?

I want use CBC mode for sending and receiving files (avi, mp3, docx, jpeg) max up to 20mb. But also I want cut this file after encryption on sending site for example on 2mb size and send each file ...
4
votes
1answer
20k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
1
vote
1answer
601 views

Why are ECB CBC and CFB parallelizable?

I guess I do not understand the word 'parallelizable'. Why are ECB CBC and CFB parallelizable? It would be nice if someone could explain it in a short way.
3
votes
1answer
490 views

Exploiting AES with IV similar to password and fixed key

While reviewing a 'secure communication protocol' made by a colleague, I noticed a usage of AES-128 CBC that caught my eye. I think they are trying to implement a HMAC but have made some very ...
0
votes
1answer
650 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
3
votes
1answer
556 views

Cipher Block Chain continued Initialization Vector

Assume a communication session between Alice and Bob (being client and server, in my case). Alice uses a secure random generator to generate both a key and an IV for use with AES in CBC mode. Alice ...
-5
votes
2answers
237 views

Ignorant Biologist in need of AES-128 CBC PKCS5 encryption key

I'm a biologist frantically trying to understand the world of cryptography overnight for research- please ignore my ignorance. I was given a large body of text to crack that is encrypted with AES-128 ...
1
vote
0answers
141 views

Can we use different mode for decryption instead of using mode which is used in encryption? [closed]

I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
8
votes
2answers
1k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
10
votes
2answers
3k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
0
votes
2answers
652 views

Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
1
vote
1answer
283 views

Security of deterministic encryption that uses CBC mode and plaintext as iv

As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode? I am sure that the second block used as IV is different than the first block ...
4
votes
2answers
646 views

ECB vs CBC for encrypting high entropy data

I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead? In particular, are the ...
2
votes
2answers
2k views

AES-CBC-128 Known plain, IV, Cipher attack

Let's say we have a single char 'A' and we encrypted it as much times as we want with a fixed Key and a random IV So now we have list of the IVs used, the result ciphers and ofc the known text "A" ...
3
votes
2answers
382 views

How does encrypt-then-MAC protect from CCA?

I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-...
2
votes
1answer
107 views

What might be the intuition for this scheme to be AEAD and what is the problem with this?

There is a plaintext message $M$, and a key $K \:\stackrel{{\scriptscriptstyle \hspace{0.2em}\$}} {\leftarrow}\ \{0,1\}^{128}$ which we will use for AES, we can extract a ciphertext $C \gets \mathrm{...
1
vote
2answers
594 views

Is there a form of AES encryption where the cipher text matches the length of the clear text and does not show patterns?

I have clear text, usually less than 10 bytes, which contains a few infrequently changing bytes. Reading: http://lollyrock.com/articles/nodejs-encryption/ I tried ...
3
votes
1answer
292 views

What kind of data is appended to the message encrypted in AES128-CBC?

I'm currently using wireshark to analyse TLSv1 traffic. I generate the traffic to an Apache (OpenSSL) using the following java (jdk 6) code : ...
2
votes
1answer
260 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
8
votes
1answer
573 views

An example of an appropriate use case for AES-CBC encryption without authentication?

I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community. Recently in this question AES in CBC Mode Is totally unsecure if ...
1
vote
0answers
4k views

how to decrypt AES CBC 256 : while you have the Key and the IV [closed]

I've been working on a forensics challenge , and I'm in the last step , i have an AES CBC 256 encrypted string and i need to decrypt it .. is there's and well known tool , or a script of some kind '...
5
votes
1answer
3k views

AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right?

Based on a lot of reading here on crypto.stackexchange.com and around the web, it seems like AES in CBC Mode is totally unsecure if no defense is provided for oracle padding attack. And it’s not just ...
8
votes
2answers
825 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
1
vote
1answer
301 views

CTR vs CBC cycles per byte with OpenSSL EVP

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption. (1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
1
vote
1answer
1k views

What is actual difference between POODLE and BEAST?

I know that both attacks are based on the fact that the cipher used for communication is block cipher with CBC mode of operation and that is vulnerable because of predictable IV. Furthermore the ...
8
votes
1answer
1k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
0
votes
1answer
152 views

cbc - why not like this? what's wrong?

ok, well... first: it's a "just for fun" question. I don't have a project dealing with this... I've simply a bit time and would like to talk a bit about some (maybe stupid) possibilities and try to ...
7
votes
1answer
253 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
4
votes
1answer
3k views

Why is Fernet only AES-128-CBC?

I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet. Fernet seems to use ...
1
vote
1answer
1k views

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

I hope that this is not a duplicate because I'm looking for nuance. I understand the difference between ECB and CBC for a block cipher, and I understand that ECB is susceptible to replay attacks, but ...
0
votes
1answer
219 views

Random unique key per message, safe to use key as IV?

The overall setup is that I am using RSA public key encryption, and because the messages are big instead of encrypting the entire message via RSA I am encrypting a random AES-128 key with the PK and ...
1
vote
1answer
697 views

Data decrypted, but unwanted characters in the beginning

I am a bit new at cryptography, I tried to recover data from an old app database, I got the key and the type of encryption, it says "AES/CBC/PKCS5Padding", I used this online tool http://8gwifi.org/...
2
votes
1answer
454 views

New AES/CBC Hack [closed]

Can someone view this video and comment? https://cipherloc.net/cipherloc-presents-details-of-encryption-attacks/ The concept is presented between 8 and 13 minutes, and then results are presented at ...
0
votes
1answer
732 views

Decrypt simple CBC message with known IV using XOR encryption

I've been given a ciphertext message, encrypted using CBC. I know that the block size is 12 bytes and I know the plaintext value of the first block. I also know that the encryption function is a ...
2
votes
2answers
926 views

CBC-MAC insecure with random IV

Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$: Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a ...
0
votes
1answer
683 views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext-iv tuple used the encrypt the plaintext? [duplicate]

i have a file, which was encrypted with AES-128 in CBC mode. I know the content of original file and know the iv used to encrypt that file.So, just wondering if it's possible to recover the key used ...
1
vote
1answer
195 views

When using AES-CBC-128, what attacks become feasible as you decrease the entropy of the IV?

16 bytes is the recommended entropy for the IV, AFAICT. Is 12 bytes of randomness with 4 fixed (across invocations of this encrypt function) bytes at the end, significantly worse? How so? What about 8 ...
1
vote
2answers
91 views

security of design for sending files

let's say I have a protocol to send a fi le $F$. I am intending to employ AES in CBC mode for encrypting $F$ where the $IV$ is randomly chosen. For authenticity, I am employing $HMAC$ to compute a ...
1
vote
2answers
315 views

using hash function of (key||plaintext) instead of random value for IV

for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption. Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $...
2
votes
1answer
109 views

Is This method of generating Initialisation Vector for Cipher Block Chaining secure?

I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary: In ...
23
votes
6answers
4k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
1
vote
3answers
1k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
2
votes
2answers
2k views

What does (block cipher) decryption parallelizable mean?

I've tried searching this answer on here and on google, but I cant seem to find a succinct answer (maybe because its obvious). My understanding from wiki/tutorialspoint/ppt is that for CBC/CFB, ...