Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
3
votes
2answers
3k views

Modes of Triple DES - When to use each?

I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in: DES-EEE3 DES-EDE3 DES-EEE2 DES-EDE2 I understand these ...
8
votes
1answer
126 views

Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

A paper published by Niels Furguson Collision attacks on OCB indicates that processing large amounts of data (somewhere on the order of $2^{32}$ 128 bit blocks) with a single encryption operation (...
9
votes
1answer
2k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
6
votes
1answer
550 views

What is the best mode of operation for file encryption with Threefish512?

In Cryptography Engineering Bruce recommends using "rand IV CBC mode" but the copy of the book I have is from 2003 and I am unsure if this is still a recommended practice with all the recent attacks ...
3
votes
1answer
417 views

AES in Counter mode for 64 bit input

I was reading how AES can be used for 64 bit data. Than i came to this answer :Is it possible to implement AES with a 64-bit I/O block size? The answer here is given that by running AES in counter ...
1
vote
1answer
509 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
7
votes
3answers
751 views

Should I use “modes of operation” for a single block of data?

I am using AES to encrypt my data. I have only 128 bit block that I am encrypting using AES. I am using AES in CTR (counter) mode, since it is always to advisable to use block ciphers along with modes ...
0
votes
1answer
878 views

AES for 64 bit plaintext

I have a 64 bit plain-text that i want to encrypt using AES. But to use AES for 64 bit plain text i can either add padding bits to it or use AES in CTR stream mode. My question is which approach ...
1
vote
3answers
3k views

Pseudo code for CTR mode encryption

I am following a document here about CTR mode of encryption. I have some point uncleared. At the part 1 Review of Counter-Mode Encryption. Operation. To encrypt using CTR-mode encryption, one ...
0
votes
1answer
883 views

Use R-CTR (randomized counter mode) to compute MAC

I've read that in conjunction with CBC-MAC, R-CTR (randomized counter mode) can be used to compute a MAC, but why wouldn't you just use a block cipher in R-CTR on its own to compute a MAC?
6
votes
2answers
382 views

Is it feasable to combine ECB and CTR block modes of operation?

Both ECB and CTR block modes have advantages over other block modes. They both support parallel encryption and decryption and random reads/writes. Yet both have major disadvantages: (I'm assuming AES ...
2
votes
1answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
2
votes
1answer
79 views

If using large keysizes, is McOE-X actually safe?

After reading the this question, I found the McOE mode of operation for tweakable block ciphers along with its "X" and "G" conversions for normal block ciphers. A quick research yielded the paper "A ...
1
vote
2answers
491 views

How effective is Serpent-256 in CTR mode?

I downloaded a compression program known as PeaZip which offers encryption and 2-way authentication also. PeaZip has an option to encrypt compressed file with variety of ciphers and one of them is ...
2
votes
1answer
2k views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
0
votes
1answer
156 views

Is this block encryption scheme using PCBC for RSA secure?

I stumbled over this post, containing code to encrypt larger messages with RSA by splitting them into blocks using PCBC mode I will copy the relevant part here, but for details see the original ...
2
votes
2answers
42 views

Is there a cipher that uses part of the already-computed ciphertext in the encryption scheme?

Are there any famous ciphers that, to determine the encrypted letter at position n in the ciphertext, it uses the encrypted letter at position n-1 in the ciphertext? I tried google but I couldn't ...
0
votes
1answer
369 views

Does the Blowfish cipher work with OFB mode?

I'm trying to implement the Blowfish cipher in Output Feedback mode. OFB mode has two operations, XOR and the block cipher. XOR inputs two blocks of the same length and outputs one block of the same ...
0
votes
2answers
851 views

How do “modes of operation” with block ciphers like (eg) DES work?

When trying to understand how “modes of operation” are applied when using block ciphers like DES, I noticed I must be missing something. Maybe I simply misunderstood or mixed up things somewhere. ...
3
votes
2answers
2k views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
2
votes
2answers
308 views

Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...
5
votes
1answer
557 views

How many blocks can securely be encrypted with XTS

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES. Through the recommendations, I've found: The length of the data unit for any instance of ...
1
vote
2answers
431 views

mode of operation in cryptography

We need to choose a mode of operation for a Telnet like application where the average message size is between 7 and 1024 bytes. What is the best mode of operation in this case? a. CBC b. CFB c. ...
3
votes
2answers
861 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
2
votes
0answers
318 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
2
votes
1answer
99 views

security of a block cipher mode of operation

Consider the following block cipher mode of operation: \begin{align} tag_0 &= mac\:key\\ plaintext_0' &= plaintext_0 \oplus iv\\ E(tag_0 | plaintext_0') = C_0 &= tag_1 | ciphertext_0\\ E(...
4
votes
0answers
218 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
6
votes
2answers
195 views

A block cipher whose key changes after each block

I have been reading about various block cipher modes of operation, and all of them seem to treat the block cipher (including it's key and key schedule) as a sort of immutable black box. I would like ...
3
votes
1answer
393 views

Are all self-synchronizing cryptosystems necessarily self-synchronizing stream ciphers?

I have a noisy communications link between two points that occasionally deletes a byte. By "self-synchronizing cryptosystem", I mean that the receiver attempting to recover the original plaintext ...
5
votes
2answers
641 views

How secure would hand ciphers be using a Block Cipher Mode?

I've been looking into different ciphers that require very minimal computation power (calculator, deck of cards, index cards and a pencil), i.e. hand ciphers. For the most part all methods typically ...
3
votes
2answers
255 views

Should I use a self-designed Block Cipher Mode of Operation?

We all know we should NOT roll our self-designed encryption algorithm, how about block cipher mode with a certificated cipher method like AES? Will a self-designed block cipher mode cause any flaws or ...
1
vote
0answers
507 views

Is it possible to create a detection oracle for all block cipher modes? — ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
1
vote
0answers
98 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
1
vote
1answer
59 views

What information about the ciphertext can an attacker discern if a key is used too many times?

Suppose that I use Blowfish or XTEA (both secure block ciphers with 64-bit block size) in CTR mode. In these cases, I need to change the key after $2^{16}$ blocks to avoid leaking information with ...
1
vote
2answers
137 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
4
votes
1answer
248 views

Block cipher mode of operation with beyond-birthday-bound security

I am looking for block cipher modes of operation that are secure even when the number of blocks encrypted exceeds the birthday bound.
1
vote
3answers
235 views

Security of a parallelizable block cipher mode

This is the scheme of a parallelizable block cipher mode of operation: $IV$ is the initialization vector. $BN$ is the zero-based index number of a block in a stream of data. $BT$ is the tweak that is ...
5
votes
1answer
253 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
1
vote
1answer
468 views

Is super encryption (aka “multiple encryption”) always good?

I'm trying to use super encryption (also known as “multiple encryption”) with AES in CFB mode with IV and password salting and AES in CTR mode both without padding. I first use AES CFB and then AES in ...
2
votes
1answer
164 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
0
votes
1answer
1k views

what problem happen if we always use IV Zero in CBC Mode? [duplicate]

i have a question about CBC operating mode. what problem happen if we always use IV Zero in CBC Mode?
6
votes
2answers
322 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...
7
votes
1answer
184 views

KFB mode - key feedback

Please, could someone explain to me how the Key feedback mode (KFB) mode works and what the IV in output block stands for? And what properties does the "constant input" has to provide? Should it be ...
4
votes
1answer
2k views

Single bit error in CBC

Why does a single bit error when using the CBC block cipher mode of operation affect the decryption of a block (Oj) with a probabilty of 50%? And in the following block, why is the one bit error in ...
3
votes
0answers
95 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
5
votes
2answers
1k views

Secure method for encrypting 32 byte private keys

I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the ...
2
votes
1answer
296 views

Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
8
votes
1answer
2k views

Effect of ESSIV when used with XTS

I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question. When formatting a partition to use LUKS, the two most common ...
6
votes
1answer
9k views

Precisely how does CBC mode use the initialization vector? [duplicate]

As I understand it, AES in CBC mode does an XOR of the 128-bit initialization vector and the first 128 bits of plain text. Is this correct? I am using the PHP 5.3 openssl extension in aes-256-cbc ...
7
votes
1answer
846 views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...