Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

34 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
115 views

What is "entropic security"?

I've come across a form of cryptographic security that I've never heard of: entropic security. I've read the Russel et al abstract and that doesn't seem to bear much relation to the wiki article. ...
Paul Uszak's user avatar
  • 15.3k
4 votes
0 answers
241 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
Demi's user avatar
  • 4,793
3 votes
0 answers
142 views

What is the Indexed Code Book Mode?

While reading specsheets for NXP processors (example mention in this PDF) the other day I saw the mention of the Indexed Code Book mode (ICB) for their AES acceleration hardware - the only mode they ...
SEJPM's user avatar
  • 45.9k
3 votes
0 answers
199 views

Extending IGE to provide authentication

I was playing around with the idea of modifying the infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
Melab's user avatar
  • 3,645
3 votes
0 answers
221 views

Does XEX mode specify how the whitening value is generated?

When the term "XEX" or the phrase "XOR-encrypt-XOR" is used, does it refer only to the scheme $CT = E_{K}(PT \oplus T) \oplus T$/$PT = E_{K}(CT \oplus T) \oplus T$ (where $T$ is the whitening/tweak ...
Melab's user avatar
  • 3,645
3 votes
0 answers
101 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
dots's user avatar
  • 31
2 votes
0 answers
108 views

Using an Even-Mansour block cipher in a tweakable mode of operation

Assume that: $P(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$. $Q(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$. $E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}} \...
Melab's user avatar
  • 3,645
2 votes
0 answers
527 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
Demi's user avatar
  • 4,793
2 votes
0 answers
58 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
SEJPM's user avatar
  • 45.9k
2 votes
0 answers
511 views

Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python

When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
Charlie Parker's user avatar
2 votes
1 answer
345 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
LightBit's user avatar
  • 1,649
1 vote
0 answers
72 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
Luce's user avatar
  • 11
1 vote
0 answers
58 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
NB_1907's user avatar
  • 610
1 vote
0 answers
44 views

Modification of CFB Mode of Operation?

To encrypt plaintext $(P_1, P_2, P_3, ... P_n)$ Ciphertext Feedback Mode (CFB) works as follows :- $$ C_0 = IV \\ C_i = E_K (C_{i-1}) \oplus P_i $$ Lets define a modified version of CFB mode as ...
crypt's user avatar
  • 2,397
1 vote
0 answers
44 views

What is aes in "operational mode"

I'm currently reading this report on the security of the IOT protocol "LoRaWAN". On page 3, it says the following: ...
NotQuiteSo1337's user avatar
1 vote
0 answers
74 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
questioner's user avatar
1 vote
0 answers
64 views

Can XEX or XTS modes be used with only one tweak? (part 2)

This question is similar to Can XEX or XTS modes be used with only one tweak? except I am interested to know if one can instead use $X = E_{k}(0) \otimes \alpha^j \\ C = E_{k}(P \oplus X) \oplus X$ in ...
Post as a guest's user avatar
1 vote
0 answers
132 views

Perfect Forward Secrecy Stream Cipher based on Block Cipher

I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
phi1010's user avatar
  • 111
1 vote
0 answers
68 views

Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?

I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
SharpShade's user avatar
1 vote
0 answers
126 views

Is PCBC using XOR still susceptible to adjacent swap attacks if a permutation is used?

PCBC with XOR as the operation used to combine the plaintext and cipherext blocks is vulnerable to adjacent swap attacks. But is it still susceptible to this attack if one of the following is done: ...
Melab's user avatar
  • 3,645
1 vote
0 answers
58 views

Upper bound of this derivative of counter mode?

Suppose that: $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$. $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$. $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$. $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$. $E(K, X): \...
Melab's user avatar
  • 3,645
1 vote
0 answers
138 views

What are the malleability properties of block device encryption with multiple modes of operation?

When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
anon's user avatar
  • 11
1 vote
0 answers
638 views

Is it possible to create a detection oracle for all block cipher modes? -- ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
cremefraiche's user avatar
1 vote
0 answers
112 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
Demi's user avatar
  • 4,793
0 votes
0 answers
63 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
0 votes
0 answers
34 views

Is there a Block cipher (mode) with a not symmetric variable which if it is altered always produced a different cipher?

The BC should look like this $$BC(m,k,n) = (c,n')$$ $$BC^{-1}(c,k,n') = (m,n)$$ with the additional variable $n$ not symmetric, so in almost all cases: $$n \not= n'$$ $m$... plaintext $c$... ...
J. Doe's user avatar
  • 573
0 votes
0 answers
51 views

Synchronous Sponges

The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
user's user avatar
  • 163
0 votes
0 answers
313 views

Is ECB mode more suitable than CBC mode while encrypting a long bit string?

I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
Sophie Elku's user avatar
0 votes
0 answers
160 views

Is XEX/XTS good for deterministic file encryption?

My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties: It is length-preserving so that encryption doesn't cost additional space. It is deterministic, which ...
Cyker's user avatar
  • 729
0 votes
0 answers
226 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
user424241's user avatar
0 votes
0 answers
150 views

AES encryption question

If we consider the generation of keys as $$\begin{aligned} K_0 &= E_K(IV); \\ K_{i+1} &= E_{K_i}(A) \end{aligned}$$ Where A is a block of zeroes, and the ciphertext blocks are computed as ...
le19's user avatar
  • 1
0 votes
0 answers
190 views

Combining stream cipher with block cipher for disk encryption

You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode. Would this be secure? Edit: To avoid getting ...
user avatar
0 votes
0 answers
45 views

Security of this parallelizable two-pass authentication scheme

This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever). ...
Melab's user avatar
  • 3,645
0 votes
0 answers
248 views

How does "one-pass" authentication differ from "two-pass"?

The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type;...
Melab's user avatar
  • 3,645