Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
327
questions
1
vote
2
answers
494
views
Cipher Block chaining but with encrypting the plain text first then xor with IV
I have just learned about the CBC mode of operation and that it gives the cipher by xoring the plaintext m0 with random IV and then encrypt it with random key and I found out that the CBC is not CPA-...
- 11
4
votes
1
answer
357
views
Regarding XEX mode
Wikipedia claims that given an unkeyed permutation $p$ (presumably of the same size as the key) this is safe: $p(m \oplus k) \oplus k$
Why isn't this construction used instead of XEX? Surely unkeyed ...
- 143
2
votes
2
answers
187
views
Interleaved CBC
I've been researching cryptographic modes and came across an obscure mode called interleaved CBC (ICBC). I can't find a lot about it and am wondering if anyone knows anything more.
It's basically CBC ...
- 896
1
vote
1
answer
355
views
IND-CPA security of mode of operation using triple AES with plaintext || IV+counter
I have found this figure of a mode of operation using a triple AES with m||IV+ctr input:
I suppose it's a custom mode of operation since I haven't seen it anywhere else. My question is if it is IND-...
2
votes
1
answer
1k
views
Is CTR really equally secure than CBC?
Here is a typical cryptographic situation:
A secret key exists that is only known to a sender and a receiver of messages. As it is hard to replace that key, since you either need a secure channel for ...
- 187
-1
votes
1
answer
58
views
Parallelizabilty and prepocessing in Modes of operation (with example)
I have a doubt about parallelizability and preprocessing in modes of operation.
I understand that these two technologies are able just when the "block" is independent.
In another way, ad example in ...
- 189
8
votes
2
answers
3k
views
What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?
I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.
There are many forms ...
- 181
2
votes
1
answer
261
views
Why is the second XOR operation in OCB mode necessary?
In Rogaway's OCB mode, the offset (derived from the key) ist XOR-added twice: Once to the plaintext block, and a second time after the Encryption.
I am wondering, why the second XOR operation is ...
- 2,508
1
vote
1
answer
676
views
How is the keystream actually generated in AES CTR
I've been trying to find out how the keystream in AES-CTR is generated, but I can't actually figure it out. Wikipedia and any other sites that "explain" it just say the nonce is padded with the ...
- 474
0
votes
2
answers
1k
views
How to generate a 128 bit IV from a 32 bit value for AES-128 OFB
I have no clue how to determine suitable 128 bit IV (initialization vector) from a 32 bit IV. Encryption AES-128 OFB. The 32 bit IV has value 0x9a23773c (...
1
vote
1
answer
181
views
Performance of Counter mode (CTR) with Ciphertext Errors
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about Counter mode (CTR) the authors say that:
"As a result, its performance is identical to OFB's ...
- 461
2
votes
2
answers
156
views
OFB mode vs LFSR
In the "Introduction to Cryptography: With Coding Theory" by Trappe and Washington, in the chapter about OFB (Output Feedback) mode the authors say that:
The OFB mode produces a bit stream and it ...
- 461
1
vote
0
answers
124
views
Perfect Forward Secrecy Stream Cipher based on Block Cipher
I'm thinking about ways to encrypt an endless stream of data (e.g. a video or audio feed) in a way, where a compromise of the current internal state of the encryption (e.g. a RAM dump) does not ...
- 111
7
votes
2
answers
2k
views
Why is ECB+CTR not a thing?
AES-CTR is nice for its parallelizability and simplicity but if you duplicate an IV you reveal plaintext.
Chaining modes like CFB and CBC don't have that problem per se but they are not ...
- 896
3
votes
1
answer
338
views
Why weak modes of operations are not banned?
If some modes of operations of AES are not secure (like ECB or CBC), which are prone to bit flipping / manipulation attacks, and why they haven't they been banned or advised against by NIST for other ...
- 125
0
votes
1
answer
1k
views
Which is the best AES mode of operation? [closed]
Is there any reason to choose, say ECB over CBC? Or GCM over AEX? Or CTR over CFB? Is there a best AES mode of operation? And, when required, which is the best padding to use?
- 474
5
votes
3
answers
1k
views
Nonce-misuse-resistance scheme applied after the fact to AES-GCM for defense in depth?
This is a follow-up to a previous question about encrypting IV/MAC results from AEAD ciphers.
I have a system I'm working on that needs to use standard (NIST/FIPS) cryptography, at least for its ...
- 896
0
votes
0
answers
149
views
AES encryption question
If we consider the generation of keys as
$$\begin{aligned}
K_0 &= E_K(IV); \\
K_{i+1} &= E_{K_i}(A)
\end{aligned}$$
Where A is a block of zeroes, and the ciphertext blocks are computed as
...
- 1
6
votes
1
answer
489
views
Using a non-secure random generator for IV or salt generation
I was just looking at a post on Code Review when I noticed the other answer to the post. While I would agree mostly with the answer, I do however doubt if having a Cryptographically Secure PRNG is ...
- 91.9k
1
vote
1
answer
1k
views
64 bit clock cipher with CFB mode. One-byte defected from ciphertext. What is the number of bits defected from plaintext
I have a question from an exam;
We encrypted a message of size 100 Bytes with CFB. In the transmission, byte number 12 got defected. How many bits defected will be in the decryption. The answer is 72 ...
2
votes
3
answers
634
views
Terminology: Is a block cipher in counter mode still considered a block cipher or is it classified as a stream cipher?
I'm confused about what terminology to use. I see people referring to such a cipher-MOO combination using both terms.
- 511
7
votes
2
answers
155
views
Does there exist a mode of operation that forces mac-then-decrypt?
Alice sends Bob a message using AES-GCM. Bob is a software developer with just enough cryptography knowledge to be dangerous. He wants to start processing data as soon as he receives it. He observes ...
- 3,283
1
vote
1
answer
4k
views
What's the best block cipher mode of operation for RSA?
I know that you should never use RSA with any block cipher mode of operation, but theoretically, what's the best block cipher mode (safest) we can use with RSA encryption - without adding any kind of ...
- 13
3
votes
2
answers
251
views
Lightweight block ciphers that support decryption with minimal overhead?
Lightweight block ciphers are mostly expressed for encryption routine and efforts are made to keep it as light as possible mostly in terms of gates count and power usage although some try to keep ...
- 2,397
17
votes
1
answer
27k
views
Bit Flipping Attack on CBC Mode
To perform a bit flipping attack, the previous block is modified by using XOR. This results in an altered plaintext. However, now the ciphertext of the previous block is altered, hence it will result ...
- 311
1
vote
1
answer
296
views
Would this mode of operation be safer?
Here the key stream is used as keys for the second level of block cipher encryption.
I guess this is not vulnerable to:
padding oracle attack because it is basically counter mode
stream cipher ...
- 37
0
votes
0
answers
189
views
Combining stream cipher with block cipher for disk encryption
You take something like chacha20 and use the disk block # to seek it, xor it with the data block and then encrypt it with a block cipher in ECB mode.
Would this be secure?
Edit:
To avoid getting ...
user64218
1
vote
3
answers
2k
views
What's the difference between confusion/diffusion and mode of operation?
I understand the concepts of confusion (substitution) and diffusion (permutation).
My understanding of what a mode is that it's an algorithm that lets us encrypt arbitrary message size. i.e. AES is ...
- 511
1
vote
1
answer
356
views
Permutation and modes of operation
I'm reading the book "Serious Cryptography A Practical Introduction to Modern Encryption" from Jean-Philippe Aumasson, and in the first chapter, it is written this :
We can try to abstract out the ...
- 11
1
vote
1
answer
2k
views
Known Plaintext Attack for Modified OFB Mode of Operation
Question: Assume a variant of the OFB mode by which we only feedback the 8 most significant bits of the cipher output. We use AES and fill the remaining 120 input bits to the cipher with 0's:
Why is ...
- 869
4
votes
1
answer
4k
views
Known Plaintext Attack on Block Cipher in ECB and CBC Modes of Operations
These 2 similar questions are from Paar's Understanding Cryptography. I could not see the answer so if someone can help I will appreciate:
Question1: We consider known plaintext attacks on block ...
- 869
3
votes
1
answer
167
views
Are there recommended modes of operation for lightweight ciphers?
There are many recommended modes of operation for block ciphers as described by NIST here, e.g. for DES and AES.
However, I am struggling to find any for lightweight ciphers. I am particularly ...
- 1,025
2
votes
4
answers
270
views
TLS ciphersuite without mode of operation
Will there be any security concern if there is no mode of operation specified in the ciphersuite name?
For instance, there is no mode of operation in ...
- 23
4
votes
3
answers
2k
views
"Weak" implementation of AES-CTR?
Assume an instantiation of AES-CTR like in the following picture:
Some details on the input-values for keystream generation:
COUNT: a 32-bit value associated with ...
- 735
1
vote
2
answers
411
views
AES blocks with a counter
I would like to send small separate packets of data.
I am thinking of using AES-128 or AES-256, and to add a counter as part of the plain text message.
Some clarifications:
Each message will be one ...
- 61
-5
votes
1
answer
391
views
AES without mode operation
i have field in database. ex: field name. this field maybe more than 16 byte. how to encrypt data more than 16 byte without cbc, etc?
any function or another ways to do this?
- 9
1
vote
1
answer
1k
views
Which block cipher mode to use?
I am working on securing a chat application, and I am not sure about which block cipher mode I should use. I am aware that I should avoid ECB as it's insecure, but what about CBC? I have watched ...
- 11
3
votes
1
answer
1k
views
Does it matter how the IV and XOR are applied for a single AES-128 block?
I want to encrypt 128 bits of data. I understand the problem with ECB, so I generate a 128-bit Initialization Vector to use for encryption and send with the encrypted data. Is there a "best" way to ...
- 203
0
votes
1
answer
588
views
3DES Feasibility and Security [closed]
Questions are as following:
Is 3DES still feasible (in terms of security and
performance) to use?
Is 3DES safe to use in ECB mode?
Every time on giving the same input (plain text) to encrypt via 3DES
...
- 103
0
votes
1
answer
201
views
Can we replace IV increasing from addition to XOR in CTR mode?
In CTR mode (not nonce-based), if we have ${IV}\stackrel{\$}{\leftarrow}\{0,1\}^{128}$ and want to encrypt message blocks $M_1, M_2, ..., M_\ell \in\{0,1\}^{128}$:
The ciphertext is $IV\parallel C_1\...
- 564
1
vote
0
answers
68
views
Is it safe to calculate the counter based on the block number in the stream rather than increasing it every write?
I've come to use AES/SIC for my purpose as I want to write an encrypted file and read it back with the possibility to seek (I only need to read parts of it and don't want to decrypt the whole file ...
- 111
0
votes
1
answer
321
views
Is this method of speeding up a symmetrical algorithm secure? (AES output joining)
I was trying to find out a way of speeding up a given symmetrical algorithm the reason and programing launguage in this case are unimportant. I have came up with the following thing:
Divide data into ...
- 3
3
votes
1
answer
229
views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
4
votes
1
answer
464
views
Random Access vs. Parallelism modes of operation
I am trying to understand some concepts regarding Random Read Access and Parallelism in mode of operations. I have written below what my concepts are regarding the two. If you can please correct where ...
- 143
1
vote
1
answer
98
views
Why do we only encrypt nounce + counter in Counter Mode?
I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted)
What ...
- 23
4
votes
4
answers
3k
views
Text partially decrypted regardless of IV
I'm trying to work out which AES cipher is best to use. I'm working with the OpenSSL ruby gem.
While testing the various options I noticed that most of the ciphers result in partial or even full ...
- 143
6
votes
3
answers
2k
views
Is error propagation desired in modes of operation
I'm taking a very simple class on cryptography. The class is not mathematical is just the very basics. We learned about modes of operations recently (such as CBC and CTR), one of the things I learned ...
- 63
3
votes
0
answers
192
views
Extending IGE to provide authentication
I was playing around with the idea of modifying the infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
- 3,645
1
vote
0
answers
123
views
Is PCBC using XOR still susceptible to adjacent swap attacks if a permutation is used?
PCBC with XOR as the operation used to combine the plaintext and cipherext blocks is vulnerable to adjacent swap attacks. But is it still susceptible to this attack if one of the following is done:
...
- 3,645
-1
votes
1
answer
2k
views
Which block cipher mode(s) can perform most of the decryption work in parallel?
Codebook (ECB), Cipher Block Chaining (CBC), Cipher Feedback (CFB), and Counter (CTR). Which of these four modes can perform most of the decryption work in parallel? Why?
- 11