Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
34
questions with no upvoted or accepted answers
4
votes
0
answers
108
views
What is "entropic security"?
I've come across a form of cryptographic security that I've never heard of: entropic security. I've read the Russel et al abstract and that doesn't seem to bear much relation to the wiki article.
...
- 15.2k
4
votes
0
answers
239
views
How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?
Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
- 4,763
3
votes
0
answers
137
views
What is the Indexed Code Book Mode?
While reading specsheets for NXP processors (example mention in this PDF) the other day I saw the mention of the Indexed Code Book mode (ICB) for their AES acceleration hardware - the only mode they ...
- 45.7k
3
votes
0
answers
192
views
Extending IGE to provide authentication
I was playing around with the idea of modifying the infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
- 3,645
3
votes
0
answers
217
views
Does XEX mode specify how the whitening value is generated?
When the term "XEX" or the phrase "XOR-encrypt-XOR" is used, does it refer only to the scheme $CT = E_{K}(PT \oplus T) \oplus T$/$PT = E_{K}(CT \oplus T) \oplus T$ (where $T$ is the whitening/tweak ...
- 3,645
3
votes
0
answers
100
views
Unknown authenticated encryption mode
I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way:
a unique 128-bit key is used;
the plaintext ...
- 31
2
votes
0
answers
107
views
Using an Even-Mansour block cipher in a tweakable mode of operation
Assume that:
$P(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$Q(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$.
$E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}} \...
- 3,645
2
votes
0
answers
525
views
Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?
OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
- 4,763
2
votes
0
answers
57
views
How can I read the AE figures?
This question is rather simple.
I've recently read the paper
"Automated Analysis and Synthesis of
Authenticated Encryption Schemes".
On page 17 of this paper the authors provide three figures of ...
- 45.7k
2
votes
0
answers
509
views
Increasing the diffusion of the AES-CBC encryption algorithm in pycrypto for python
When encryption is done using the AES-CBC algorithm, the encryption can be thought of as chaining the cipher texts with the previous ones and an IV. However, if its on CBC mode, we give our cipher ...
- 265
2
votes
1
answer
328
views
CTR overlap with random IV
Problem:
I'm slightly worried about counter repeats in CTR mode when using random IV.
If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
- 1,649
1
vote
0
answers
63
views
What mode in EVP for AES-128 should I use for cryptanalysis of AES?
I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*.
I need to use AES-128 ...
- 11
1
vote
0
answers
57
views
Authenticated Encryption with Length Expansion for Storage Devices
Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general.
I know that ...
- 538
1
vote
0
answers
40
views
Modification of CFB Mode of Operation?
To encrypt plaintext $(P_1, P_2, P_3, ... P_n)$ Ciphertext Feedback Mode (CFB) works as follows :-
$$
C_0 = IV \\
C_i = E_K (C_{i-1}) \oplus P_i
$$
Lets define a modified version of CFB mode as ...
- 2,397
1
vote
0
answers
44
views
What is aes in "operational mode"
I'm currently reading this report on the security of the IOT protocol "LoRaWAN".
On page 3, it says the following:
...
1
vote
0
answers
72
views
CTR mode calculate messages before new key is required
I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR).
I have just two simple questions:
At around 4:30 in the video they show 2^48 without saying where ...
- 145
1
vote
0
answers
61
views
Can XEX or XTS modes be used with only one tweak? (part 2)
This question is similar to Can XEX or XTS modes be used with only one tweak? except I am interested to know if one can instead use
$X = E_{k}(0) \otimes \alpha^j \\
C = E_{k}(P \oplus X) \oplus X$
in ...
1
vote
0
answers
124
views
Perfect Forward Secrecy Stream Cipher based on Block Cipher
I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
- 111
1
vote
0
answers
68
views
Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?
I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
- 111
1
vote
0
answers
123
views
Is PCBC using XOR still susceptible to adjacent swap attacks if a permutation is used?
PCBC with XOR as the operation used to combine the plaintext and cipherext blocks is vulnerable to adjacent swap attacks. But is it still susceptible to this attack if one of the following is done:
...
- 3,645
1
vote
0
answers
58
views
Upper bound of this derivative of counter mode?
Suppose that:
$\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$.
$\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$.
$\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$.
$\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$.
$E(K, X): \...
- 3,645
1
vote
0
answers
136
views
What are the malleability properties of block device encryption with multiple modes of operation?
When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
- 11
1
vote
0
answers
627
views
Is it possible to create a detection oracle for all block cipher modes? -- ciphertext-only cryptanalysis
I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
- 111
1
vote
0
answers
112
views
Reykeyed AES in CTR mode as a stream cipher
Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key.
Assuming that AES is a secure PRP:
Is this a secure stream ...
- 4,763
0
votes
0
answers
32
views
Is there a Block cipher (mode) with a not symmetric variable which if it is altered always produced a different cipher?
The BC should look like this
$$BC(m,k,n) = (c,n')$$
$$BC^{-1}(c,k,n') = (m,n)$$
with the additional variable $n$ not symmetric, so in almost all cases:
$$n \not= n'$$
$m$... plaintext
$c$... ...
- 573
0
votes
1
answer
98
views
Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?
The following question is from Stanford cryptography course final exam paper.
Suppose an attacker intercepts a ciphertext c which is the encryption of a message m ε {0, 1}^n under nonce-based counter ...
0
votes
0
answers
51
views
Synchronous Sponges
The paper The sponge construction as a source of secure
cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
- 153
0
votes
0
answers
313
views
Is ECB mode more suitable than CBC mode while encrypting a long bit string?
I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
0
votes
0
answers
153
views
Is XEX/XTS good for deterministic file encryption?
My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties:
It is length-preserving so that encryption doesn't cost additional space.
It is deterministic, which ...
- 729
0
votes
0
answers
222
views
Another cut-and-paste attack on CBC mode
I am trying to see specific cases of attacks in the CBC mode, in particular, I am investigating some attacks such as Example of a cut-and-paste attack on CBC. Here I have posted something similar and ...
- 131
0
votes
0
answers
149
views
AES encryption question
If we consider the generation of keys as
$$\begin{aligned}
K_0 &= E_K(IV); \\
K_{i+1} &= E_{K_i}(A)
\end{aligned}$$
Where A is a block of zeroes, and the ciphertext blocks are computed as
...
- 1
0
votes
0
answers
189
views
Combining stream cipher with block cipher for disk encryption
You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode.
Would this be secure?
Edit:
To avoid getting ...
user64218
0
votes
0
answers
45
views
Security of this parallelizable two-pass authentication scheme
This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever).
...
- 3,645
0
votes
0
answers
248
views
How does "one-pass" authentication differ from "two-pass"?
The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type;...
- 3,645