Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

File/Dir/Tar encryption pipeline - what md/cipher/mode? [migrated]

I'm piping the results of a tar operation into openssl. File size is typically less than 10GiB. I've been doing some reading and come up with what I think would be considered secure and fast enough in ...
15
votes
1answer
8k views

GCM vs CTR+HMAC tradeoffs

So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
2
votes
1answer
70 views

Quadruple DES vs AES-128 security

I came across this question regarding the security of Quadruple DES (hypothetically DES done four times) in CBC encryption mode vs security of AES-128 in CBC encryption mode. What parameters help to ...
1
vote
2answers
41 views

Multiple IV CBC

CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
1
vote
1answer
624 views

Padding Oracle Attack with AES-128-CTR and MAC

Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm. Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
0
votes
0answers
25 views

Where can I find test vectors of special mode of block cipher, such as CBCC, PCBC, EPBC, IOBC

Now, I am learning cryptography about block cipher. I plan to implement the mode of operator about it. I have know some modes, such as ECB, CBC, OFB, CFB, CTR. These modes are common and I have ...
-1
votes
1answer
59 views

Which encryption mode is best for transport of random values?

I was wondering which block encryption mode or modes will be most appropriate for transport of random values of one-block length. Block length could be of size 256 bytes and transport is from person ...
0
votes
0answers
41 views

The smallest secure block size [duplicate]

I have designed an encryption algorithm. The algorithm will probably use CFB mode. The algorithm can encrypt any block size and this does not change the size of the key. There are always about $20$ ...
1
vote
1answer
137 views

Does not using padding mean a lack of security?

I've read several texts which say that if the entire plaintext is a multiple of the block-size padding is not required (and not using padding would not mean a loss of security). I generally disagree ...
77
votes
9answers
114k views

Should I use ECB or CBC encryption mode for my block cipher?

Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
1
vote
2answers
90 views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
0
votes
0answers
52 views

Is XEX/XTS good for deterministic file encryption?

My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties: It is length-preserving so that encryption doesn't cost additional space. It is deterministic, which ...
2
votes
1answer
75 views

CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure. My ...
79
votes
1answer
138k views

What is the difference between CBC and GCM mode?

I am trying to learn more about GCM mode and how it differs between CBC. I already know that GCM provides a MAC which is used for message authentication. From what I have read, and from the code ...
0
votes
1answer
95 views

How to figure out DES mode used given plaintext and ciphertext?

In DES, I'm given the following exercise. - How can I find out which part of the plaintext each ciphertext message corresponds to, and which mode they were each encrypted with?
17
votes
3answers
16k views

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file? How hard is it?...
2
votes
1answer
173 views

Why is XEX not used instead of CTR?

As far as I know the only disadvantage that XEX has when compared to CTR is that you need a block cipher/permutation while CTR is fine with just a hash function. Meanwhile XEX offers the advantage ...
0
votes
1answer
36 views

How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for ...
0
votes
1answer
92 views

What is the difference between cfb and cfb1 and cfb8 ? ( like openssl's aria-128-cfb & aria-128-cfb1 & aria-128-cfb8 )

What is the difference between cfb and cfb1 and cfb8 ? like openssl's aria-128-cfb and aria-128-cfb1 and ...
1
vote
2answers
79 views

Modes of operation that simply uses the tweak of a tweakable block cipher

What is the name of the mode in which we simply change the tweak for each block without the need for complex chaining modes? Is this mode secure? Are there any other recommended modes for native ...
5
votes
3answers
541 views

Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?

This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers. I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
15
votes
2answers
2k views

Is CBC really dead?

I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV. ...
0
votes
0answers
65 views

Another cut-and-paste attack on CBC mode

I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
1
vote
2answers
119 views

Cipher Block chaining but with encrypting the plain text first then xor with IV

I have just learned about the CBC mode of operation and that it gives the cipher by xoring the plaintext m0 with random IV and then encrypt it with random key and I found out that the CBC is not CPA-...
4
votes
1answer
86 views

Regarding XEX mode

Wikipedia claims that given an unkeyed permutation $p$ (presumably of the same size as the key) this is safe: $p(m \oplus k) \oplus k$ Why isn't this construction used instead of XEX? Surely unkeyed ...
2
votes
2answers
73 views

Interleaved CBC

I've been researching cryptographic modes and came across an obscure mode called interleaved CBC (ICBC). I can't find a lot about it and am wondering if anyone knows anything more. It's basically CBC ...
1
vote
1answer
87 views

IND-CPA security of mode of operation using triple AES with plaintext || IV+counter

I have found this figure of a mode of operation using a triple AES with m||IV+ctr input: I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
37
votes
3answers
7k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3 . from what I know CBC is the most secure Mode of operation for the AES block cipher ( if you can say it like that ) It only needs a TRND IV ...
1
vote
1answer
180 views

Is CTR really equally secure than CBC?

Here is a typical cryptographic situation: A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
7
votes
2answers
556 views

OCB and GCM security

Is OCB as secure as GCM or CCM ? Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
-1
votes
1answer
31 views

Parallelizabilty and prepocessing in Modes of operation (with example)

I have a doubt about parallelizability and preprocessing in modes of operation. I understand that these two technologies are able just when the "block" is independent. In another way, ad example in ...
0
votes
0answers
27 views

Blockcipher operation mode pros/cons when used on a database?

say i have a database with multiple independent entries, which i want to encrypt using a block cipher like AES. Which operation mode would be suited for that purpose? I assume entries can't be ...
2
votes
0answers
264 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
2
votes
1answer
81 views

Why is the second XOR operation in OCB mode necessary?

In Rogaway's OCB mode, the offset (derived from the key) ist XOR-added twice: Once to the plaintext block, and a second time after the Encryption. I am wondering, why the second XOR operation is ...
36
votes
2answers
24k views

Practical disadvantages of GCM mode encryption

It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
83
votes
1answer
119k views

What is the difference between PKCS#5 padding and PKCS#7 padding

One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
32
votes
1answer
33k views

What is the advantage of XTS over CBC mode (with diffuser)?

I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser. I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
1
vote
1answer
81 views

How is the keystream actually generated in AES CTR

I've been trying to find out how the keystream in AES-CTR is generated, but I can't actually figure it out. Wikipedia and any other sites that "explain" it just say the nonce is padded with the ...
0
votes
2answers
271 views

How to generate a 128 bit IV from a 32 bit value for AES-128 OFB

I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
25
votes
2answers
12k views

Why should I use Authenticated Encryption instead of just encryption?

There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption. Why should I use an authenticated ...
6
votes
3answers
2k views

What is the likely cause the RSA algorithm gives back plain text in this case?

Text book question of Chapter 9 of "Crypto and Network Security" by William Stallings: When using the RSA Algorithm — if a small number of repeated encodings give back the plain text, what is the ...
2
votes
2answers
71 views

OFB mode vs LFSR

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about OFB (Output Feedback) mode the authors say that: The OFB mode produces a bit stream and it ...
1
vote
1answer
48 views

Performance of Counter mode (CTR) with Ciphertext Errors

In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that: "As a result, its performance is identical to OFB's ...
3
votes
1answer
135 views

Why weak modes of operations are not banned?

If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other ...
1
vote
0answers
64 views

Perfect Forward Secrecy Stream Cipher based on Block Cipher

I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
0
votes
1answer
369 views

Does the Blowfish cipher work with OFB mode?

I'm trying to implement the Blowfish cipher in Output Feedback mode. OFB mode has two operations, XOR and the block cipher. XOR inputs two blocks of the same length and outputs one block of the same ...
7
votes
3answers
1k views

Why is ECB+CTR not a thing?

AES-CTR is nice for its parallelizability and simplicity but if you duplicate an IV you reveal plaintext. Chaining modes like CFB and CBC don't have that problem per se but they are not ...
0
votes
1answer
385 views

Which is the best AES mode of operation? [closed]

Is there any reason to choose, say ECB over CBC? Or GCM over AEX? Or CTR over CFB? Is there a best AES mode of operation? And, when required, which is the best padding to use?
3
votes
2answers
3k views

Modes of Triple DES - When to use each?

I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in: DES-EEE3 DES-EDE3 DES-EEE2 DES-EDE2 I understand these ...
9
votes
1answer
1k views

AES-CTR mode and the Biclique Attack

The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...

1
2 3 4 5 6