Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
88
questions
18
votes
1
answer
30k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 321
22
votes
5
answers
9k
views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
- 415
38
votes
2
answers
24k
views
Why should I use Authenticated Encryption instead of just encryption?
There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption.
Why should I use an authenticated ...
- 4,317
99
votes
1
answer
168k
views
What is the difference between PKCS#5 padding and PKCS#7 padding
One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
- 92.6k
21
votes
4
answers
22k
views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is it?...
- 375
15
votes
3
answers
11k
views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
- 46.1k
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
- 46.1k
22
votes
3
answers
23k
views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
- 540
22
votes
2
answers
4k
views
Is (AES-)GCM parallelizable?
I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
- 46k
36
votes
2
answers
27k
views
Practical disadvantages of GCM mode encryption
It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
- 92.6k
83
votes
9
answers
138k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
39
votes
3
answers
11k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,455
24
votes
1
answer
6k
views
(Why) should I avoid using a randomized IV for CTR mode?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
- 1
21
votes
1
answer
3k
views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
- 785
12
votes
3
answers
3k
views
Using a Non-Random IV with modes other than CBC
The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
- 1,496
1
vote
1
answer
2k
views
64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext
I have a question from an exam;
We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 ...
61
votes
3
answers
13k
views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
- 711
10
votes
3
answers
14k
views
Encryption with "constant" initialization vector considered harmful
I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice.
For stream ciphers not doing ...
- 203
10
votes
2
answers
17k
views
AES plaintext is smaller than 128 bits - how to expand?
We are currently developing a little AES implementation in a crypto-course at university.
As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
- 255
9
votes
2
answers
35k
views
Cipher Feedback Mode
I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC.
Can someone explain to me how CFB works. Such as how ...
- 1,727
9
votes
1
answer
9k
views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
- 1,001
6
votes
1
answer
3k
views
How much data can I encrypt with AES before I need to change the key in CBC mode?
In my cryptography class, the instructor suggested that in order to give the attacker a minimal advantage of $1/2^{32}$, we have to change the key after $2^{48}$ blocks are encrypted.
It seems that ...
- 2,631
92
votes
2
answers
173k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,283
37
votes
1
answer
51k
views
What is the advantage of XTS over CBC mode (with diffuser)?
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
- 473
13
votes
3
answers
16k
views
Difference between a nonce and IV
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
- 861
12
votes
1
answer
4k
views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
- 24.9k
11
votes
1
answer
11k
views
Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
- 1
9
votes
1
answer
2k
views
Practical uses of Manipulation Detection Code (MDC) and IGE
I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:
We show that generic compositions of confidentiality-...
- 92.6k
9
votes
1
answer
2k
views
What are the constraints on using GCM with a tag size of 96 and 128 bits?
Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default).
NIST SP ...
- 92.6k
9
votes
2
answers
485
views
Will varying plaintext compensate for a fixed initialisation vector?
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.
I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
8
votes
3
answers
2k
views
Maximum Number of Blocks to be Encrypted under One Key in CBC and CTR Mode?
What is the Limit on Maximum Number of Blocks to be Encrypted under One Key in CBC and CTR Mode? What happens if the limit is crossed and more number of blocks are encrypted?
- 2,427
7
votes
1
answer
3k
views
Has GMAC mode a future outside GCM?
Once gcm has been implemented for providing both encryption & authentication solution , it appears obvious to consider that such implementation can also provide (if required by new user) a Mac ...
- 653
4
votes
4
answers
2k
views
Which block cipher modes of operation allow a predictable IV?
Recently I found out that in the modes CBC and PCBC the IV may be passed in cleartext but never must be predictable. However for this part of my app I rather have the IV be predictable and unique (i.e....
user2651
3
votes
1
answer
1k
views
What is the use of segments in Cipher Feedback Mode (CFB)
In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation
CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
- 92.6k
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 281
15
votes
2
answers
23k
views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
- 253
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
- 2,631
10
votes
1
answer
8k
views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
9
votes
2
answers
3k
views
Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:
...
- 193
9
votes
1
answer
11k
views
Error propagation in CBC mode
Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
- 861
6
votes
3
answers
6k
views
Why does CBC decryption with a wrong IV still give readable results?
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.
My encryption was correct. I was generating a random IV block and writing ...
- 295
6
votes
3
answers
2k
views
Is error propagation desired in modes of operation
I'm taking a very simple class on cryptography. The class is not mathematical is just the very basics. We learned about modes of operations recently (such as CBC and CTR), one of the things I learned ...
- 63
6
votes
3
answers
3k
views
What is the likely cause the RSA algorithm gives back plain text in this case?
Text book question of Chapter 9 of "Crypto and Network Security" by William Stallings:
When using the RSA Algorithm — if a small number of repeated encodings give back the plain text, what is the ...
- 6,184
6
votes
1
answer
3k
views
Security of authenticated encryption modes GCM & CCM
I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
- 653
5
votes
2
answers
1k
views
Post-quantum authenticated encryption
It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong.
However, these statements are always made ...
- 189
5
votes
1
answer
515
views
GCM: Math behind update of AAD after ciphertext has been processed
In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper):
Some AAD was sent ...
- 92.6k
5
votes
2
answers
1k
views
What (precisely) is a block cipher?
If I follow the wikipedia or crypto.stackexchange definition, any simple XOR encryption where the key is as long as the plain text should qualify as a secure block cipher.
Now I thought what would ...
- 345
4
votes
2
answers
2k
views
AES-ECB as an authentication mechanism
ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication?
Assume A wants to transmit an ...
- 736
2
votes
1
answer
2k
views
Repeated NONCE in CTR mode
My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
- 23
1
vote
1
answer
5k
views
What's the best block cipher mode of operation for RSA?
I know that you should never use RSA with any block cipher mode of operation, but theoretically, what's the best block cipher mode (safest) we can use with RSA encryption - without adding any kind of ...
- 13