Questions tagged [cbc]

Cipher block chaining (CBC) is a method for encrypting large amounts of data with a block cipher that can only encrypt fixed length plaintexts. When used with an unpredictable initialization vector (IV), it is secure against chosen plaintext attacks (CPA-secure).

Filter by
Sorted by
Tagged with
9
votes
1answer
2k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
0
votes
1answer
183 views

cbc - why not like this? what's wrong?

ok, well... first: it's a "just for fun" question. I don't have a project dealing with this... I've simply a bit time and would like to talk a bit about some (maybe stupid) possibilities and try to ...
7
votes
1answer
292 views

Predictable, but private IV in CBC

It is said that a predictable IV is dangerous, because you can do adaptive chosen plaintext attacks. But if the IV is never seen to the attacker, is it still dangerous? What I mean, is that the IV is ...
5
votes
1answer
7k views

Why is Fernet only AES-128-CBC?

I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet. Fernet seems to use ...
2
votes
1answer
2k views

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

I hope that this is not a duplicate because I'm looking for nuance. I understand the difference between ECB and CBC for a block cipher, and I understand that ECB is susceptible to replay attacks, but ...
0
votes
1answer
246 views

Random unique key per message, safe to use key as IV?

The overall setup is that I am using RSA public key encryption, and because the messages are big instead of encrypting the entire message via RSA I am encrypting a random AES-128 key with the PK and ...
1
vote
1answer
1k views

Data decrypted, but unwanted characters in the beginning

I am a bit new at cryptography, I tried to recover data from an old app database, I got the key and the type of encryption, it says "AES/CBC/PKCS5Padding", I used this online tool http://8gwifi.org/...
2
votes
1answer
625 views

New AES/CBC Hack [closed]

Can someone view this video and comment? https://cipherloc.net/cipherloc-presents-details-of-encryption-attacks/ The concept is presented between 8 and 13 minutes, and then results are presented at ...
0
votes
1answer
1k views

Decrypt simple CBC message with known IV using XOR encryption

I've been given a ciphertext message, encrypted using CBC. I know that the block size is 12 bytes and I know the plaintext value of the first block. I also know that the encryption function is a ...
2
votes
2answers
2k views

CBC-MAC insecure with random IV

Prove that the following modification of $\operatorname{CBC-MAC}$ does not yield a secure fixed-length $\operatorname{MAC}$: Modify $\operatorname{CBC-MAC}$ so that a random $IV$ is used each time a ...
0
votes
1answer
952 views

Is it possible to obtain AES-128 key from a known ciphertext-plaintext-iv tuple used the encrypt the plaintext? [duplicate]

i have a file, which was encrypted with AES-128 in CBC mode. I know the content of original file and know the iv used to encrypt that file.So, just wondering if it's possible to recover the key used ...
1
vote
1answer
298 views

When using AES-CBC-128, what attacks become feasible as you decrease the entropy of the IV?

16 bytes is the recommended entropy for the IV, AFAICT. Is 12 bytes of randomness with 4 fixed (across invocations of this encrypt function) bytes at the end, significantly worse? How so? What about 8 ...
1
vote
2answers
94 views

security of design for sending files

let's say I have a protocol to send a fi le $F$. I am intending to employ AES in CBC mode for encrypting $F$ where the $IV$ is randomly chosen. For authenticity, I am employing $HMAC$ to compute a ...
2
votes
2answers
458 views

using hash function of (key||plaintext) instead of random value for IV

for a protocol which implements AES under CBC mode, an $IV $(initialization vector) is required for each encryption. Instead of picking the $IV$ randomly, is it advisable for us to set the $IV$ to be $...
3
votes
1answer
146 views

Is This method of generating Initialisation Vector for Cipher Block Chaining secure?

I have worries about security defined in BACnet protocol (ASHRAE/ANSI Standard 135, ISO 16484-5). Full text of security is here: http://bacnet.org/Addenda/Add-135-2008g.pdf and here is my summary: In ...
23
votes
6answers
4k views

Why not authenticate full-disk encryption?

Common FDE software (TrueCrypt, BitLocker, dm-crypt) doesn't authenticate ciphertext stored on the disk. The commonly cited reason is "it would take too much space", reasoning that you would need an ...
2
votes
3answers
3k views

Chosen Plaintext Attack on DES/AES

PERSON A sends messages to PERSON B using AES, CBC, PKCS5Padding with an IV that is incremented by one after each message. If PERSON Z knows that the first block of the plain-text of any message is ...
3
votes
2answers
4k views

What does (block cipher) decryption parallelizable mean?

I've tried searching this answer on here and on google, but I cant seem to find a succinct answer (maybe because its obvious). My understanding from wiki/tutorialspoint/ppt is that for CBC/CFB, ...
2
votes
1answer
2k views

What is CCM — Counter Mode Cipher Block Chaining Message Authentication Code Protocol

CCM puts together two different modes of operation (at least in the name). Does it mean data is encrypted using counter mode and then encrypted using CBC; kind of a double encryption?
1
vote
2answers
495 views

Cipher Block Chaining

I don't want the answer to this problem, I just want to understand the steps that need to be followed to solve it. Maybe an example could help. Problem We use $\mathbin\Vert$ for concatenation. ...
1
vote
0answers
962 views

CBC mode is not IND-CCA2 secure with no prediction of IV

How can it be explained that CBC mode is not IND-CCA2 secure, in case that the IV can't be predicted by adversary. Edit: In decryption of CBC, for each block it is XORed with previous block's cipher ...
2
votes
1answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
1
vote
0answers
97 views

AES CBC Initialization vector - Security issues [duplicate]

I have 2 questions regarding security issues related to initialization vectors used in AES CBC Consider that I'm using a sequence number (which increments with every encryption) as an initialization ...
1
vote
1answer
215 views

Difference between XORing the IV and just pre-pending it to the plaintext before encryption with AES-CBC [duplicate]

The normal way of using AES-CBC is to XOR the IV with the first plaintext block This way you have to pass the IV along the ciphertext. What if instead of XORing we just put a fixed size randomIV in ...
2
votes
2answers
992 views

How does a Padding Oracle Attack work in practice?

I have understood how the padding oracle attack works in theory. Now, I am trying to visualize it in a real scenario. Can someone please give a real scenario in which an attacker can insert himself ...
9
votes
3answers
19k views

Best way to generate a IV for AES-CBC when encrypting files?

The situation is that I want to use symmetric encryption to store some info in files. I'm going to use AES-CBC algorithm. The user is going to remember the password (meaning it will not be stored ...
2
votes
1answer
187 views

Can you help me understand some details about the attack using SSL3 POODLE bytes?

I have read some articles or books (e.g., “Bulletproof SSL and TLS”) about POODLE, but they still don't answer my questions – which are: From https://www.openssl.org/~bodo/ssl-poodle.pdf, ...
2
votes
2answers
293 views

Clarification on the origin of `01` in this oracle padding attack?

I have found what I believe to be a straightforward explanation of the oracle padding attack here: http://robertheaton.com/2013/07/29/padding-oracle-attack/ I am however getting confused by something ...
2
votes
1answer
3k views

HMAC vs CMAC, which is faster?

I want to know which is faster-HMAC or CMAC.I know CMAC is based on block cipher encryption,where output of each block is X-OR with the next plain text block. If security is not a concern,which will ...
-4
votes
1answer
2k views

bruteforce on aes 256 cbc mode [closed]

i have a series of encrypted text , they encrypted by aes 256 bit cbc mode for every encrypted text there is an iv that i have them also and i know its algorithm is aes 256 bit cbc mode i can ...
4
votes
2answers
693 views

CBC mode with same plaintext

I'm working on a file encryption system where multiple versions of the same file might exist. The filenames are encrypted using AES in CBC mode with a random IV and stored in metadata. Since versions ...
6
votes
1answer
1k views

Generating an IV for AES-CBC

I am faced with the task of generating a secure 256-bit IV for AES-CBC. I possess the following resources: A 32-bit microprocessor A 32-bit PRNG (can read/reseed) A 64-bit clock counter (can read) ...
2
votes
1answer
207 views

Why is a one-time MAC secure for MAC-then-encrypt with randomized-CTR but not randomized-CBC?

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
1
vote
1answer
626 views

Is double AES-CBC encryption with the same key and IV unsafe?

If some plaintext encrypted twice with the same AES function (CBC-mode), same IV and same key, is it possible to retrieve either the key or the plaintext?
0
votes
1answer
299 views

CPA on theoretical OTP with CBC mode

Body of question Note: this is THEORETICAL exercise. I understand OTP and CBC does not get along. I have to find a CPA on CBC enc-mode using OTP as the encryption algorithm, s.t a new key is ...
1
vote
1answer
3k views

Question about Cipher Block Chaining(CBC)

I'm studying at the moment the CBC Encryption method,and I was asked in an excercise how many bits would be wrong after decryption if during the transmission 2 bits are interchanged. My guess is that ...
1
vote
2answers
435 views

mode of operation in cryptography

We need to choose a mode of operation for a Telnet like application where the average message size is between 7 and 1024 bytes. What is the best mode of operation in this case? a. CBC b. CFB c. ...
1
vote
2answers
2k views

Parallel file encryption and authentication for large files

For a cloud storage upload client I want to encrypt files during upload, so that they cannot be read by the cloud service provider or anyone who gains access to the account. I would like to use some ...
1
vote
2answers
1k views

How to crack unknown 8-bit encryption algorithm?

Can anyone tell me how to crack the encryption of 8 bit algorithm, when you have some clue that CBC mode is used, but the algorithm is secret. You also have some encrypted data (chosen plain text), ...
3
votes
2answers
881 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
4
votes
0answers
159 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
1
vote
1answer
497 views

Disk encryption using AES-CBC: is reliance on previous block data a downside?

I have seen drives that boast that they use AES with CBC mode, which doesn't really make sense in my opinion, sure it's more secure than ECB (but actually, leaving security aside, ECB is better suited ...
0
votes
1answer
764 views

File using same key on XOR cipher. Using CBC [closed]

I have some files that are encrypted using an unknown key and it's using the CBC method to encrypt the files. When I XOR two files together the first two bytes are always the same, but different for ...
1
vote
1answer
228 views

Is it safe to use the same IV for multiple encryptions in AES CBC mode when you are always encrypting random bytes?

I am generating random bytes (16 or 32 bytes at a time), and I want to encrypt them using a 128 bit AES key in CBC mode. Am I really weakening this horribly if I am reusing the same IV and key each ...
0
votes
1answer
72 views

Proper authenticated encryption

I am using AES-CBC, authenticating using HMAC-SHA512 and I was wondering whether my thought process and implementation are correct. The message send over the network is: HMAC(64Bytes),IV(16Bytes),...
2
votes
0answers
657 views

TLS padding format

My question is about how the padding is formated in TLS1.0, 1.1, 1.2, 1.3 I came across the PKCS7 format for the padding: ...
1
vote
0answers
49 views

What is the benefit of artificially padding messages? [duplicate]

For ECB, CBC, and CFB, padding is required when the plaintext does not fill out a complete multiple of the block size. However, I have heard that is good practice to pad all messages, even if the ...
1
vote
0answers
43 views

Which protocols / file formats use CBC with a random IV and without a MAC?

Disclaimer: I am a noob so this may well be a stupid question or one that's been asked before. I didn't see it come up after searching, though, so I'm going to assume it hasn't been asked here. The ...
6
votes
1answer
1k views

Is there any benefit to verifying PKCS#7 padding when using AES CBC and HMAC?

As I'm using HMAC to ensure integrity and authenticity of the ciphertext, is there any additional security benefit to verifying PKCS#7 padding when decrypting using AES CBC? A previous question asked ...
5
votes
2answers
2k views

How to show that this modification of CBC-MAC is insecure?

I'm working on some cryptography problems, found this and I'm not sure how to solve it: Modify CBC-MAC so that all blocks $t_1,\dots,t_l$ are output rather than just $t_l$ and prove it is not ...

1
3 4
5
6 7
9