Questions tagged [cbc]
Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).
487
questions
4
votes
0
answers
367
views
AES key reuse between CTR and CBC
The question
Given the same plaintext content that is encrypted two times.
One time with AES-CTR and the other time with AES-CBC.
Both times with the same AES key but with different IVs.
What are ...
2
votes
1
answer
735
views
Is it safe to use unauthenticated AES CBC when encrypting random bytes?
I am studying an application with an AES crypto implementation that works that like the following:
PBKDF2 is used with X iterations and SHA-256 to generate a 256-bit "master key" from a user-provided ...
- 581
-1
votes
1
answer
2k
views
How can you change this message which is in block cipher AES-256 in CBC?
Given is the secret message encrypted with AES-256 in CBC mode
5a04ec902686fb05a6b7a338b6e07760 14c4e6965fc2ed2cd358754494aceffa
The first 16 Byte is the initial ...
- 101
3
votes
1
answer
229
views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
2
votes
2
answers
164
views
How much data do I leak if I use the first bytes of a file as AES-CBC IV?
I found a piece of code that uses the first 16 bytes of the input file as IV. This immediately set off some flags in my head, but I have no idea how bad it really is. So, how bad is it? Obviously we'...
- 1,003
5
votes
2
answers
3k
views
Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?
In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer:
After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt),
it ...
- 407
0
votes
2
answers
670
views
Modification of block cipher in CBC mode
I know that CBC is not secure against data modification. Can someone explain to me by illustrating at an example how I could change the last block if I have the encryption of "0"?
Thanks in advance
3
votes
1
answer
5k
views
AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token
I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp.
Now, I tried to use AES-128-GCM, ...
- 919
0
votes
1
answer
286
views
CBC first block malleability
Let $m_1 = \underbrace{ \{0,1\}^n \times \cdots \times \{0,1\}^n }_{L\text{ times}}$ be a message of space $\mathcal{M}^L$, where $\mathcal{M} = \{0,1\}^n$.
Let $c_1$ be the encryption of $m_1$ ...
- 447
0
votes
1
answer
565
views
CBC-MAC using predictable IV
Imagine you have a string of plaintext (a), IV (ai) and the MAC (am) for the plaintext (<...
user58341
3
votes
2
answers
1k
views
Is CBC block cipher mode susceptible to reordering attacks?
Regarding reordering attacks, is CBC block cipher as vulnerable as ECB? why? If CBC can prevent reordering attacks (that is, after reordering, the decrypted plaintext will make nonsense so the ...
user58233
10
votes
4
answers
5k
views
Are there any benefits to using ECB over CBC?
From what I have understood about ECB and CBC, CBC is far better as it doesn't reveal any pattern. There have been several questions here about how ECB is bad:
Should I use ECB or CBC encryption mode ...
- 203
5
votes
2
answers
3k
views
Can AES-CBC be safely used in combination with RSA, or must it be CBC-MAC?
The plan is to encrypt files using an AES-256 in CBC mode secret key. The secret key itself will be encrypted with a RSA 2048-bit public key.
Is using AES-CBC sufficiently secure if used in ...
- 53
3
votes
1
answer
3k
views
Is zero IV with AES-CBC safe if CPA is not possible and indistinguishability is not an issue?
Is using zero IVs with AES-CBC safe, if chosen-plaintext attack (CPA) is not possible and ciphertext indistinguishability is not an issue?
Practical example:
...
- 133
2
votes
2
answers
850
views
AES CBC: how shall i get to know with AES CBC method, the received Cipher Text is padded or not [closed]
Algorithm: AES - CBC mode with PKCS7 padding
KeyValue:
10a58869d74be5a374cf867cfb473859
IV:
...
- 253
4
votes
1
answer
2k
views
CBC - Cipher-text stealing decryption
(I asked in stackoverflow and I should ask my question here not there, sorry about that)
The graph shows CBC- with cipher-text stealing and (b) is the block length. The output cipher-text is c1,...,...
- 43
-2
votes
2
answers
1k
views
0
votes
1
answer
2k
views
CMAC Generation : If input payload length is not aligned in 16 bytes, what are the possible side effects?
While searching for answers ,I understand that RFC AES-CMAC 4493 is suggested by NIST to overcome if payload is not aligned in 16 bytes.
I would like to know what drawbacks/insecure caused by AES-...
- 253
3
votes
3
answers
18k
views
Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?
I am currently using AES256 in CBC mode with PKCS7 Padding to encrypt some data. It seems like the output size is not always a power of two, which was what I expected.
Is it possible to calculate the ...
- 75
1
vote
2
answers
4k
views
CBC Mode error during encryption
In CBC mode I know that if i get a corrupted Ci* block than Pi and Pi+1 will be wrong during the decryption, but i believe that this happens only when Ci* is not envolved during the feedback stage at ...
- 11
1
vote
1
answer
196
views
Cut through mode for TLS AES-CBC / SHA ciphersuite
I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode.
Let's suppose that received record spans two segments.
As i understood HMAC ...
- 187
3
votes
1
answer
1k
views
Cryptopals challenge 2.11: Distinguish ECB and CBC encryption
I'm going through the Matasano crypto challenges (also known as cryptopals) and I recently got stuck in the following challenge: http://cryptopals.com/sets/2/challenges/11
The goal of the challenge ...
- 33
5
votes
1
answer
1k
views
In a AES-CBC + HMAC architecture, Is it secure to send a second IV in a message to a device incapable of producing satisfactory random numbers?
There are many threads here explaining the need of a random and unpredictable IV for the AES-CBC.
I am building a home automation system with security for a school project where a Raspberry Pi ...
- 153
1
vote
1
answer
5k
views
Get IV from Key, Clear and Cipher text in AES-256 CBC
Newbie question here but can I get the IV if I know the Key, plain text and chiper text ?
(I thought that if I encrypt 16 first bytes of clear with the key and 16 first bytes of cipher text as IV it ...
- 13
0
votes
1
answer
397
views
Given an AES-CBC encrypted string, IV, and plain text, how can I compute the key?
If I have the AES-CBC encrypted string along with the IV and the plain text before encryption, how can I compute the key which was used for encryption?
- 11
39
votes
3
answers
10k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,415
1
vote
1
answer
423
views
How HMAC is calculated for TLS AES_128_CBC_SHA
The RFC 5246 defines generic block cipher as follow:
struct {
opaque IV[SecurityParameters.record_iv_length];
...
- 187
3
votes
1
answer
143
views
Would a simplified CBC-MAC be safe?
Would using the ciphertext of the previous block as key instead of XOR:ing the block and encrypting with the normal key work?
Normally it's done like this:
What if we instead do this:
Seems like it ...
- 145
0
votes
2
answers
704
views
In use of AES CBC, can a cipher text signature be replaced with appending a known string to the plain text?
Would appending a known string to the end of plain text then validating the string after decrypting adequately verify the authenticity of the cipher text?
- 13
2
votes
1
answer
410
views
calculate ESS IV initialization vector for aes-cbc essiv encryption
I want to do block level encrypton on my ext4 image file system with aes-cbc-essiv
How can I find/calculate the the ESSIV needed for encryption?
2
votes
3
answers
671
views
Do I need to generate unique IV for CBC encryption of a file if I encrypt multiple blocks of data?
The situation is that I download a mp3 file (song) and I encrypt blocks of data (4096 bites for example).
The output of every encryption operation I save it in a new file.
When I play the song (...
- 21
0
votes
1
answer
6k
views
How to perform the padding oracle attack on AES CBC?
Assume I am the attacker. I want to break the plaintext by performing the padding oracle attack on AES CBC mode. I know the following information:
...
- 477
6
votes
2
answers
4k
views
Is the CBC mode of operation a stream cipher mode?
I am taking a class on security systems. My professor considers CBC to be a stream cipher mode, like CFB and OFB. Most sources I have read do not agree with this, so I asked my professor about this, ...
user41777
3
votes
1
answer
325
views
Security proof for CBC as a prefix-free PRF
I am currently trying to fully understand Dan Boneh's/ Victor Shoup's proof in their excellent crypto book draft, that the raw CBC construction is a secure pseudo random function family for prefix-...
- 171
3
votes
1
answer
2k
views
Security of AES counter mode vs. CBC mode
For AES-CBC to be CPA secure the IV that is used has to be randomly selected for each packet. If the IV is predictable than the encryption is not CPA secure. Is the same true for AES-CTR mode? that is,...
- 1,066
0
votes
1
answer
410
views
How to use CPA on AES128-CBC with constant Key and IV to leak info?
I'm doing a challenge in which I need to login to a server as an admin to capture a flag.
I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters.
The flow is as follows:...
8
votes
1
answer
2k
views
Why was Vaudenay's original padding oracle attack not exploitable on TLS 1.0?
Reading Password Interception in a SSL/TLS Channel that was released in 2003:
At Eurocrypt’02, Vaudenay presented vulnerabilities in padding schemes used for block ciphers in CBC mode. He used a ...
- 1,535
0
votes
1
answer
200
views
Is CBC still better than ECB if the key and a large part of the texts are random?
I am doing protection for my software, which involves storing a part of the crucial algorithm inside a smart-card based dongle. I will supply the input to the dongle, and I will expect the output of ...
- 109
3
votes
1
answer
426
views
Attack on AES-CBC with small pool of IV
Let's assume that for encryption with AES in CBC mode we have $IV\in \{0\}^{113}||\{0,1\}^{15}$.
I know that if we can predict next IV with 100% probability there is attack that completely breaks ...
- 249
5
votes
1
answer
1k
views
AES CBC with unique key per message, but fixed IV
I'm working on a project with a scheme in which c[i] = AES-CBC-Encrypt(msg_key[i], IV, msg[i]), and two distinct plaintexts never have identical keys. ...
- 779
1
vote
3
answers
2k
views
AES CBC mode is good for encrypting 15-20mb files and then sending it in parts?
I want use CBC mode for sending and receiving files (avi, mp3, docx, jpeg) max up to 20mb. But also I want cut this file after encryption on sending site for example on 2mb size and send each file ...
- 381
7
votes
1
answer
49k
views
Why is padding used in CBC mode?
I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
- 253
1
vote
1
answer
2k
views
Why are ECB CBC and CFB parallelizable?
I guess I do not understand the word 'parallelizable'. Why are ECB CBC and CFB parallelizable?
It would be nice if someone could explain it in a short way.
- 121
3
votes
1
answer
733
views
Exploiting AES with IV similar to password and fixed key
While reviewing a 'secure communication protocol' made by a colleague, I noticed a usage of AES-128 CBC that caught my eye. I think they are trying to implement a HMAC but have made some very ...
- 93
1
vote
1
answer
1k
views
NIST's Methods for Key Wrapping?
NIST has specified a full Mode of Operation for Key wrapping. What are the pros and cons of key wrapping mode of operation as compared to CBC, CTR or authenticated encryption mode?
- 2,397
3
votes
1
answer
898
views
Cipher Block Chain continued Initialization Vector
Assume a communication session between Alice and Bob (being client and server, in my case). Alice uses a secure random generator to generate both a key and an IV for use with AES in CBC mode.
Alice ...
- 2,320
-5
votes
2
answers
435
views
Ignorant Biologist in need of AES-128 CBC PKCS5 encryption key
I'm a biologist frantically trying to understand the world of cryptography overnight for research- please ignore my ignorance. I was given a large body of text to crack that is encrypted with AES-128 ...
- 1
1
vote
0
answers
197
views
Can we use different mode for decryption instead of using mode which is used in encryption? [closed]
I am decrypting the Apple Payment Token in Demandware, the apple pay token is encrypted in GCM mode, but in Demandware, we don't have GCM mode in Cipher class, so can I use other modes for decryption? ...
- 11
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
- 45.9k
15
votes
2
answers
8k
views
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
I've been doing a lot of reading on the proper way to implement AES CBC mode with HMAC authentication. I've seen many explanations, however, I've had a hard time finding an actual real example (with ...
- 581