Skip to main content

Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
92 votes
2 answers
174k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
0 votes
1 answer
50 views

Difference between AES-128 FIPS-197 & AES-128 CBC workflow

For a single block of 16 bytes... The following is the workflow of AES-128 FIPS-197 which produces the correct output using NIST test vector from page 35: ...
5 votes
1 answer
222 views

New NIST Journey: Accordion Cipher Mode

NIST recently unveiled the criteria for crafting a new block cipher mode of operation for AES called Accordion Cipher Mode. Simultaneously, they've announced Ascon as the Winner in the Lightweight ...
3 votes
2 answers
173 views

Quantum attack on CTR

I'm reading the article named "Characterizing the qIND-qCPA (in)security of the CBC, CFB, OFB and CTR modes of operation". An attack on CTR mode is presented in the article. The proof of thm ...
1 vote
1 answer
83 views

Can ECB block cipher mode be used to implement CTR?

looking at the linux kernel provided cipher and block cipher modes cat /proc/crypto my prefered mode CTR (counter/integer) is ...
4 votes
1 answer
357 views

Why is s=6n in AES Key Wrap?

In AES Key Wrap, we apply 6n AES encryptions for an input of n 64-bit blocks. Informally speaking, we wrap the key 6 times. What is the motivation behind 6? Why not 4 or 10? Is there something like a ...
0 votes
1 answer
119 views

Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?

The following question is from Stanford cryptography course final exam paper. Suppose an attacker intercepts a ciphertext $c$ which is the encryption of a message $m\in\{0,1\}^n$ under nonce-based ...
0 votes
0 answers
67 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
1 vote
1 answer
128 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
10 votes
2 answers
3k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
1 vote
1 answer
131 views

How secure is half-key Even-Mansour?

Single-key Even-Mansour is secure up to $2^{0.5 \times n}$. Where $n$ is permutation and key size. Would using $n/2$-key retain same security as $n$-key? Could the other half be used as a tweak?
2 votes
2 answers
144 views

Recommended way to generate a key and IV for CFB mode?

I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
1 vote
1 answer
71 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
3 votes
0 answers
213 views

Extending IGE to provide authentication

I was playing around with the idea of modifying the infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
1 vote
1 answer
74 views

Is it a bad idea to swap modes/encryption primitives?

I was wondering if changing modes or primitives could affect security. For example, let's say you have encrypted data with AES-128 with CBC mode and you want to change it to AES-128 GCM, or to ASCON. ...
1 vote
1 answer
221 views

Are modes like CBC, OFB, CFB subject to chosen plaintext attacks?

I haven't found much info on the internet about the weakness of modes to chosen plaintext attacks, but from what I understand of them, there seem to be some trivial attacks, so I'm a bit confused. For ...
2 votes
1 answer
114 views

Pros and cons about padding a cryptogram produced with an "additive" operation mode

These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes. You ...
1 vote
0 answers
79 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
2 votes
1 answer
584 views

Vulnerability due to same IV, same key, same plaintext at same position in OFB

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the ...
1 vote
0 answers
61 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
4 votes
1 answer
114 views

Which ciphers have been defined that use the Keccak sponge?

There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
2 votes
1 answer
173 views

Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
4 votes
1 answer
162 views

What would be the maximum acceptable block size for disk enryption?

AES-256 in XTS mode has 32x16 (512) bytes of blocksize but there are some other wide-block modes of operation such as WCFB which accepts any block size. My question is: What is the maximum acceptable ...
1 vote
1 answer
66 views

Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?

A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
18 votes
1 answer
31k views

Bit Flipping Attack on CBC Mode

To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
1 vote
0 answers
56 views

Modification of CFB Mode of Operation?

To encrypt plaintext $(P_1, P_2, P_3, ... P_n)$ Ciphertext Feedback Mode (CFB) works as follows :- $$ C_0 = IV \\ C_i = E_K (C_{i-1}) \oplus P_i $$ Lets define a modified version of CFB mode as ...
1 vote
1 answer
635 views

Why is ECB mode unsafe if the key is kept secret?

this is my first post so I apologise if the formatting of my post isn't perfect. I should start off by saying that this post is not for any malicious intent, rather for curiosity and understanding AES ...
5 votes
3 answers
3k views

Why isn't CTR mode (counter mode) used more often?

For the CTR mode, the design is good for parallelization, yes, it seems the benchmark of the program downloaded from crypto++ proves that on an Intel I7 CPU. My question is that as most of CPU on ...
4 votes
0 answers
120 views

What is "entropic security"?

I've come across a form of cryptographic security that I've never heard of: entropic security. I've read the Russel et al abstract and that doesn't seem to bear much relation to the wiki article. ...
1 vote
1 answer
2k views

Modes of operation for Public Key Encryption schemes

Symmetric key encryption schemes have well defined modes of operations for achieving deterministic (ECB) or Randomized (CBC, OFB, CTR ) etc. and other applications of the same. But are they defined ...
2 votes
1 answer
399 views

ECB... lacks diffusion(?)

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption. ...
1 vote
0 answers
44 views

What is aes in "operational mode"

I'm currently reading this report on the security of the IOT protocol "LoRaWAN". On page 3, it says the following: ...
2 votes
1 answer
307 views

"Fixing" PCBC mode?

In PCBC mode, one encrypts and decrypts via $$ C_i = E(P_i \oplus P_{i-1} \oplus C_{i-1}) \Longleftrightarrow P_i = D(C_i) \oplus P_{i-1} \oplus C_{i-1} $$ (where $P_0 \oplus C_0 = IV$), which has ...
8 votes
1 answer
172 views

Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

A paper published by Niels Furguson Collision attacks on OCB indicates that processing large amounts of data (somewhere on the order of $2^{32}$ 128-bit blocks) with a single encryption operation (...
2 votes
1 answer
349 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
1 vote
0 answers
77 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
2 votes
1 answer
278 views

Why is the second XOR operation in OCB mode necessary?

In Rogaway's OCB mode, the offset (derived from the key) ist XOR-added twice: Once to the plaintext block, and a second time after the Encryption. I am wondering, why the second XOR operation is ...
3 votes
1 answer
250 views

Why does the Gameboy Advance serial encryption include the destination byte address?

The Gameboy Advance encrypts data sent over its serial port. It assembles a random number to seed a linear congruential generator. Then, it xors this PRN, the data, a symmetric key, and the byte ...
4 votes
1 answer
919 views

Why are block ciphers mostly used as stream ciphers?

Using a block cipher with using either CTR or GCM mode gives us a stream cipher, the only difference being that CTR does not include a MAC tag or AAD but GCM does. I think these are the most commonly ...
9 votes
2 answers
3k views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
1 vote
2 answers
908 views

How to minimize AES output size?

I work on a project about CAN bus and I want to encrypt the data among nodes but I have have a problem because CAN bus nodes receive and send 8 bytes among each others and I know the size of AES ...
83 votes
9 answers
138k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
0 votes
1 answer
395 views

How to figure out DES mode used given plaintext and ciphertext?

In DES, I'm given the following exercise. - How can I find out which part of the plaintext each ciphertext message corresponds to, and which mode they were each encrypted with?
1 vote
2 answers
963 views

AES plaintext is smaller than 128 bits [duplicate]

I'm currently developing a AES implementation in a graduation project at university. As far as I know, AES uses a 128 bit block length as input . if the entered string to encrypt is not 128 bits such ...
1 vote
1 answer
808 views

Can ChaCha20 provide integrity?

I have read that in general stream ciphers do not provide data integrity. Can ChaCha20 be implemented in such a way (perhaps like counter mode with message authentication in AES) to provide this?
0 votes
0 answers
51 views

Synchronous Sponges

The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
3 votes
0 answers
147 views

What is the Indexed Code Book Mode?

While reading specsheets for NXP processors (example mention in this PDF) the other day I saw the mention of the Indexed Code Book mode (ICB) for their AES acceleration hardware - the only mode they ...
0 votes
0 answers
315 views

Is ECB mode more suitable than CBC mode while encrypting a long bit string?

I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
3 votes
1 answer
1k views

OCB - brute force against unknown IV

I read that brute force attacks against a plaintext encrypted in OCB with unknown key and IV has approximately the same complexity as an attack where only the key is unknown. Why is that? Is there a ...
4 votes
1 answer
332 views

How do I decide what mode to use?

I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...

1
2 3 4 5
7