Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
327
questions
99
votes
1
answer
164k
views
What is the difference between PKCS#5 padding and PKCS#7 padding
One runtime platform provides an API that supplies PKCS#5 padding for block cipher modes such as ECB and CBC. These modes have been defined for the triple DES, AES and Blowfish block ciphers. The ...
- 91.9k
91
votes
2
answers
170k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,273
83
votes
9
answers
137k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
60
votes
3
answers
13k
views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
- 701
39
votes
3
answers
10k
views
Why was AES CBC removed in TLS 1.3?
I don't quite understand why AES CBC was removed in TLS1.3.
From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that).
It only needs a TRND IV ...
- 4,415
38
votes
2
answers
23k
views
Why should I use Authenticated Encryption instead of just encryption?
There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption.
Why should I use an authenticated ...
- 4,297
36
votes
1
answer
49k
views
What is the advantage of XTS over CBC mode (with diffuser)?
I have some problems in understanding the "advantage" of AES-XTS compared to CBC with diffuser.
I read something about FileVault, in this paper they mention the two modes of operations XTS and CBC (...
- 463
36
votes
2
answers
27k
views
Practical disadvantages of GCM mode encryption
It seems that GCM mode encryption has a clear advantage over CBC + HMAC in the sense that it only requires a single key. But it seems that there are some experts here that do not trust it enough to ...
- 91.9k
33
votes
2
answers
14k
views
Why do we need special key-wrap algorithms?
Wikipedia says:
Key Wrap constructions are a class of symmetric encryption algorithms designed to
encapsulate (encrypt) cryptographic key material.
We are using these algorithms to encrypt (and ...
- 22.5k
24
votes
1
answer
6k
views
(Why) should I avoid using a randomized IV for CTR mode?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
- 1
22
votes
5
answers
9k
views
Using CBC with a fixed IV and a random first plaintext block
What if, instead of using CBC mode in the normal way with a random IV, I used this approach:
Use a fixed IV (like a block of 0's).
Before encrypting, generate a random block and prepend it to the ...
- 415
22
votes
2
answers
4k
views
Is (AES-)GCM parallelizable?
I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
- 45.7k
21
votes
3
answers
22k
views
Is AES in CBC mode secure if a known and/or fixed IV is used?
I have a need to encrypt credentials for a third-party app used by a secured internal app. Over on ITSec.SE, I was helpfully shown a scheme to encrypt the third-party credentials based on a hash of ...
- 530
20
votes
4
answers
21k
views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is it?...
- 365
20
votes
1
answer
3k
views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
- 775
19
votes
3
answers
11k
views
Modes of operation that allow padding oracle attacks
It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why?
...
- 91.9k
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 281
17
votes
1
answer
27k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 311
17
votes
1
answer
4k
views
What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
It seems the only specified CTR mode ciphers in TLS are all GCM based.
GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field ...
- 447
15
votes
3
answers
11k
views
Is using a predictable IV with CFB mode safe or not?
While writing this answer, I noted that NIST SP 800-38A says that (emphasis mine):
"For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be ...
- 45.9k
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
- 2,601
15
votes
2
answers
22k
views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
- 253
15
votes
2
answers
2k
views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
- 315
13
votes
3
answers
15k
views
Difference between a nonce and IV
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
- 861
12
votes
4
answers
4k
views
What is the difference between a 'cipher' and a 'mode of operation'?
What is the difference between the term cipher (a name like RIJNDAEL) and mode of operation (like ECB)?
Aren't these both terms for the encryption/decryption technique?
- 229
12
votes
3
answers
3k
views
Using a Non-Random IV with modes other than CBC
The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
- 1,486
12
votes
1
answer
4k
views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
- 24.8k
11
votes
1
answer
10k
views
Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
- 1
10
votes
2
answers
17k
views
AES plaintext is smaller than 128 bits - how to expand?
We are currently developing a little AES implementation in a crypto-course at university.
As far as I know, AES uses a 128 bit block length, so all data that will be encrypted gets split up into ...
- 255
10
votes
3
answers
14k
views
Encryption with "constant" initialization vector considered harmful
I try to get the full reasoning behind the above statement. First, after reading articles here and at wikipedia i understand that using an IV only once is good practice.
For stream ciphers not doing ...
- 203
10
votes
1
answer
8k
views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
10
votes
1
answer
4k
views
Why doesn't CTR mode require blocking?
I've been reading a bit about block cipher modes and I have a relatively straightforward question regarding CTR. In essence, I was hoping you guys would be kind enough to validate my understanding of ...
- 211
10
votes
1
answer
3k
views
CBC-Mode Infinite Garble Extension
A variation of the CBC mode is the Infinite Garble Extension.
I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
- 393
10
votes
2
answers
3k
views
Authenticated encryption mode for stream cipher?
Block ciphers have modes like GCM or OCB that combine primitives to provide both authentication and encryption.
Are there similar constructs for stream ciphers, which provide both authentication and ...
- 231
10
votes
1
answer
2k
views
AES-CTR mode and the Biclique Attack
The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption ...
- 4,405
10
votes
1
answer
1k
views
Why is authenticated CFB mode insecure?
I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it:
Let $P_1,P_2,\ldots P_n$ be the ...
- 417
10
votes
2
answers
3k
views
Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?
In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
- 45.9k
9
votes
2
answers
2k
views
Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:
...
- 193
9
votes
2
answers
35k
views
Cipher Feedback Mode
I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC.
Can someone explain to me how CFB works. Such as how ...
- 1,727
9
votes
2
answers
468
views
Will varying plaintext compensate for a fixed initialisation vector?
This is a follow-up question to Relative merits of AES ECB and CBC modes for securing data at rest.
I need to store encrypted Personal Account Numbers (PANs) in a database. The only encryption option ...
9
votes
1
answer
11k
views
Error propagation in CBC mode
Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
- 861
9
votes
1
answer
1k
views
How can disk encryption systems (like Truecrypt) resist frequency analysis when they allow random access?
I don't understand how disk encryption (e.g. TrueCrypt) is supposed to resist frequency analysis.
If blocks can be randomly accessed (which they can), doesn't that mean that frequency-domain ...
- 1,349
9
votes
1
answer
2k
views
Practical uses of Manipulation Detection Code (MDC) and IGE
I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:
We show that generic compositions of confidentiality-...
- 91.9k
9
votes
1
answer
2k
views
What are the constraints on using GCM with a tag size of 96 and 128 bits?
Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default).
NIST SP ...
- 91.9k
9
votes
1
answer
3k
views
Effect of ESSIV when used with XTS
I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question.
When formatting a partition to use LUKS, the two most common ...
- 193
9
votes
1
answer
9k
views
Why, or when, to use an Initialization Vector?
i'm trying to figure out when an Intialization Vector (IV) should be used.
There are anecdotal reports that WEP was broken because of weak IV's. It's also claimed that if two pieces of plaintext are ...
- 1,001
8
votes
3
answers
941
views
Is this encryption algorithm built from MD5 secure?
I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm ...
- 83
8
votes
3
answers
1k
views
Should I use “modes of operation” for a single block of data?
I am using AES to encrypt my data. I have only 128 bit block that I am encrypting using AES. I am using AES in CTR (counter) mode, since it is always to advisable to use block ciphers along with modes ...
- 575
8
votes
2
answers
3k
views
How do we compute IV+1 in CTR mode?
This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation?
For example, if I have the IV ...
- 3,922
8
votes
2
answers
3k
views
What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?
I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.
There are many forms ...
- 181