Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

Filter by
Sorted by
Tagged with
3
votes
1answer
465 views

Exploiting AES with IV similar to password and fixed key

While reviewing a 'secure communication protocol' made by a colleague, I noticed a usage of AES-128 CBC that caught my eye. I think they are trying to implement a HMAC but have made some very ...
0
votes
1answer
618 views

NIST's Methods for Key Wrapping?

NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
3
votes
1answer
533 views

Cipher Block Chain continued Initialization Vector

Assume a communication session between Alice and Bob (being client and server, in my case). Alice uses a secure random generator to generate both a key and an IV for use with AES in CBC mode. Alice ...
-5
votes
2answers
230 views

Ignorant Biologist in need of AES-128 CBC PKCS5 encryption key

I'm a biologist frantically trying to understand the world of cryptography overnight for research- please ignore my ignorance. I was given a large body of text to crack that is encrypted with AES-128 ...
1
vote
0answers
140 views

Can we use different mode for decryption instead of using mode which is used in encryption? [closed]

I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
8
votes
2answers
987 views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
10
votes
2answers
3k views

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
0
votes
2answers
614 views

Recover key given partial key, IV and cipher text using CBC mode

Given a known IV and a small part of the key (not enough to use brute force) is there are any way to break CBC encryption with only one cipher text?
1
vote
1answer
271 views

Security of deterministic encryption that uses CBC mode and plaintext as iv

As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode? I am sure that the second block used as IV is different than the first block ...
4
votes
2answers
633 views

ECB vs CBC for encrypting high entropy data

I have a master AES key and I need to encrypt other AES keys with this key. Is ECB safe to encrypt highly random data (a key)? What benefit would I get if I use CBC instead? In particular, are the ...
2
votes
2answers
1k views

AES-CBC-128 Known plain, IV, Cipher attack

Let's say we have a single char 'A' and we encrypted it as much times as we want with a fixed Key and a random IV So now we have list of the IVs used, the result ciphers and ofc the known text "A" ...
3
votes
2answers
366 views

How does encrypt-then-MAC protect from CCA?

I am an application developer, implementing client-side crypto to protect data that is then transmitted to be stored on a server. The application uses AES with CBC mode with a resulting encrypt-then-...
2
votes
1answer
107 views

What might be the intuition for this scheme to be AEAD and what is the problem with this?

There is a plaintext message $M$, and a key $K \:\stackrel{{\scriptscriptstyle \hspace{0.2em}\$}} {\leftarrow}\ \{0,1\}^{128}$ which we will use for AES, we can extract a ciphertext $C \gets \mathrm{...
1
vote
2answers
566 views

Is there a form of AES encryption where the cipher text matches the length of the clear text and does not show patterns?

I have clear text, usually less than 10 bytes, which contains a few infrequently changing bytes. Reading: http://lollyrock.com/articles/nodejs-encryption/ I tried ...
3
votes
1answer
264 views

What kind of data is appended to the message encrypted in AES128-CBC?

I'm currently using wireshark to analyse TLSv1 traffic. I generate the traffic to an Apache (OpenSSL) using the following java (jdk 6) code : ...
2
votes
1answer
253 views

CBC Padding Oracle in SSL3. Why only in SSL3 not in TLS1,TLS1.1, etc

I read about PODDLE attack which downgrades the TLS version to SSL 3.0 to exploit CBC padding oracle attack. I looked at the specs for TLS 1.1 And found CBC is still used in its ciphersuites. Why is ...
8
votes
1answer
550 views

An example of an appropriate use case for AES-CBC encryption without authentication?

I have been learning a lot by studying the questions and answers here on crypto.stackexchange.com and an grateful for this community. Recently in this question AES in CBC Mode Is totally unsecure if ...
1
vote
0answers
4k views

how to decrypt AES CBC 256 : while you have the Key and the IV [closed]

I've been working on a forensics challenge , and I'm in the last step , i have an AES CBC 256 encrypted string and i need to decrypt it .. is there's and well known tool , or a script of some kind '...
5
votes
1answer
2k views

AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right?

Based on a lot of reading here on crypto.stackexchange.com and around the web, it seems like AES in CBC Mode is totally unsecure if no defense is provided for oracle padding attack. And it’s not just ...
7
votes
2answers
792 views

CBC variant: why encrypt the nonce with a different key?

I am a newbie at cryptography. I understand the CBC encryption, somewhat. You don't want to use the same "IV" for every message because then the ciphers are not very random. My question is regarding ...
1
vote
1answer
295 views

CTR vs CBC cycles per byte with OpenSSL EVP

I did some benchmarking using the EVP calls of OpenSSL in C, for CBC and CTR encryption/decryption. (1) : I got 3.2 Cycles/Byte for CBC encryption. (2) : I got 0.7 Cycles/Byte for CBC decryption, CTR ...
1
vote
1answer
1k views

What is actual difference between POODLE and BEAST?

I know that both attacks are based on the fact that the cipher used for communication is block cipher with CBC mode of operation and that is vulnerable because of predictable IV. Furthermore the ...
8
votes
1answer
1k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
0
votes
1answer
151 views

cbc - why not like this? what's wrong?

ok, well... first: it's a "just for fun" question. I don't have a project dealing with this... I've simply a bit time and would like to talk a bit about some (maybe stupid) possibilities and try to ...
7
votes
1answer
249 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
4
votes
1answer
3k views

Why is Fernet only AES-128-CBC?

I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet. Fernet seems to use ...
1
vote
1answer
997 views

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

I hope that this is not a duplicate because I'm looking for nuance. I understand the difference between ECB and CBC for a block cipher, and I understand that ECB is susceptible to replay attacks, but ...
0
votes
1answer
207 views

Random unique key per message, safe to use key as IV?

The overall setup is that I am using RSA public key encryption, and because the messages are big instead of encrypting the entire message via RSA I am encrypting a random AES-128 key with the PK and ...
1
vote
1answer
646 views

Data decrypted, but unwanted characters in the beginning

I am a bit new at cryptography, I tried to recover data from an old app database, I got the key and the type of encryption, it says "AES/CBC/PKCS5Padding", I used this online tool http://8gwifi.org/...
2
votes
1answer
431 views

New AES/CBC Hack [closed]

Can someone view this video and comment? https://cipherloc.net/cipherloc-presents-details-of-encryption-attacks/ The concept is presented between 8 and 13 minutes, and then results are presented at ...
0
votes
1answer
697 views

Decrypt simple CBC message with known IV using XOR encryption

I've been given a ciphertext message, encrypted using CBC. I know that the block size is 12 bytes and I know the plaintext value of the first block. I also know that the encryption function is a ...
2
votes
2answers
890 views

CBC-MAC insecure with random IV

Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$: Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a ...
0
votes
1answer
637 views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext-iv tuple used the encrypt the plaintext? [duplicate]

i have a file, which was encrypted with AES-128 in CBC mode. I know the content of original file and know the iv used to encrypt that file.So, just wondering if it's possible to recover the key used ...
1
vote
1answer
189 views

When using AES-CBC-128, what attacks become feasible as you decrease the entropy of the IV?

16 bytes is the recommended entropy for the IV, AFAICT. Is 12 bytes of randomness with 4 fixed (across invocations of this encrypt function) bytes at the end, significantly worse? How so? What about 8 ...
1
vote
2answers
90 views

security of design for sending files

let's say I have a protocol to send a fi le $F$. I am intending to employ AES in CBC mode for encrypting $F$ where the $IV$ is randomly chosen. For authenticity, I am employing $HMAC$ to compute a ...
1
vote
2answers
305 views

using hash function of (key||plaintext) instead of random value for IV

for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption. Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $...
2
votes
1answer
104 views

Is This method of generating Initialisation Vector for Cipher Block Chaining secure?

I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary: In ...
23
votes
6answers
4k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
1
vote
3answers
1k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
2
votes
2answers
2k views

What does (block cipher) decryption parallelizable mean?

I've tried searching this answer on here and on google, but I cant seem to find a succinct answer (maybe because its obvious). My understanding from wiki/tutorialspoint/ppt is that for CBC/CFB, ...
2
votes
1answer
2k views

What is CCM — Counter Mode Cipher Block Chaining Message Authentication Code Protocol

CCM puts together two different modes of operation (at least in the name). Does it mean data is encrypted using counter mode and then encrypted using CBC; kind of a double encryption?
1
vote
0answers
652 views

CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
2
votes
1answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
1
vote
0answers
78 views

AES CBC Initialization vector - Security issues [duplicate]

I have 2 questions regarding security issues related to initialization vectors used in AES CBC Consider that I'm using a sequence number (which increments with every encryption) as an initialization ...
1
vote
1answer
136 views

Difference between XORing the IV and just pre-pending it to the plaintext before encryption with AES-CBC [duplicate]

The normal way of using AES-CBC is to XOR the IV with the first plaintext block This way you have to pass the IV along the ciphertext. What if instead of XORing we just put a fixed size randomIV in ...
2
votes
2answers
735 views

How does a Padding Oracle Attack work in practice?

I have understood how the padding oracle attack works in theory. Now, I am trying to visualize it in a real scenario. Can someone please give a real scenario in which an attacker can insert himself ...
6
votes
3answers
11k views

Best way to generate a IV for AES-CBC when encrypting files?

The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored ...
2
votes
1answer
150 views

Can you help me understand some details about the attack using SSL3 POODLE bytes?

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
2
votes
2answers
251 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
2
votes
1answer
2k views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...