Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

Why use CCM instead CBC-then-MAC?

Is there any reason why CCM was created with encryption/decryption being done with a counter versus using CBC-then-MAC?
Melab's user avatar
  • 3,645
6 votes
3 answers
633 views

Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?

The question that I am asking is exactly what I ask in the title.
Melab's user avatar
  • 3,645
3 votes
1 answer
229 views

Why does the Gameboy Advance serial encryption include the destination byte address?

The Gameboy Advance encrypts data sent over its serial port. It assembles a random number to seed a linear congruential generator. Then, it xors this PRN, the data, a symmetric key, and the byte ...
Brian Graham's user avatar
1 vote
0 answers
58 views

Upper bound of this derivative of counter mode?

Suppose that: $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$. $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$. $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$. $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$. $E(K, X): \...
Melab's user avatar
  • 3,645
1 vote
1 answer
2k views

Padding Oracle Attack with AES-128-CTR and MAC

Assume Alice and Bob are communicating using 'MAC then Encrypt' paradigm. Specifically, they are using HMAC with SHA256 as the hash function and the output is truncated to 40 bits. They are using AES-...
AnswerFinder95's user avatar
2 votes
0 answers
107 views

Using an Even-Mansour block cipher in a tweakable mode of operation

Assume that: $P(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$. $Q(X): \{0, 1\}^{\ell_{X}} \rightarrow \{0, 1\}^{\ell_{X}}$. $E(K, X): \{0, 1\}^{\ell_{K}} \times \{0, 1\}^{\ell_{X}} \...
Melab's user avatar
  • 3,645
3 votes
0 answers
217 views

Does XEX mode specify how the whitening value is generated?

When the term "XEX" or the phrase "XOR-encrypt-XOR" is used, does it refer only to the scheme $CT = E_{K}(PT \oplus T) \oplus T$/$PT = E_{K}(CT \oplus T) \oplus T$ (where $T$ is the whitening/tweak ...
Melab's user avatar
  • 3,645
3 votes
1 answer
1k views

Cryptopals challenge 2.11: Distinguish ECB and CBC encryption

I'm going through the Matasano crypto challenges (also known as cryptopals) and I recently got stuck in the following challenge: http://cryptopals.com/sets/2/challenges/11 The goal of the challenge ...
Lior Moshe's user avatar
2 votes
1 answer
466 views

How does CCM handle variable-length messages?

Since CBC-MAC is insecure for variable-length messages if nothing is done to handle them, I'm wondering how it can be used with variable-length messages. Rogaway's critique of CCM indicates that it ...
Melab's user avatar
  • 3,645
39 votes
3 answers
10k views

Why was AES CBC removed in TLS 1.3?

I don't quite understand why AES CBC was removed in TLS1.3. From what I know CBC is the most secure Mode of operation for the AES block cipher (if you can say it like that). It only needs a TRND IV ...
Richard R. Matthews's user avatar
3 votes
2 answers
1k views

Security of AES in CTR mode with fixed nonce (but different key)

If I am using AES in CTR mode and use a unique key every time but the same nonce, is this secure? If so, does it make a difference if the nonce is public?
Sherif Awad's user avatar
1 vote
1 answer
83 views

Desirability of chaining an LCG in an authentication scheme

Suppose that: $E(k, x)$ is the encryption of data block $x$ with key $k$ using a block cipher. $L_{Key}$ is the key size of the block cipher in bits. $L_{Block}$ is the block size of the block cipher ...
Melab's user avatar
  • 3,645
1 vote
0 answers
136 views

What are the malleability properties of block device encryption with multiple modes of operation?

When encrypting a block device with a given symmetric cipher with a 128-bit block size in CBC mode, every second plaintext block in a sector can be changed to contain arbitrary data, with the blocks ...
anon's user avatar
  • 11
8 votes
3 answers
2k views

Maximum Number of Blocks to be Encrypted under One Key in CBC and CTR Mode?

What is the Limit on Maximum Number of Blocks to be Encrypted under One Key in CBC and CTR Mode? What happens if the limit is crossed and more number of blocks are encrypted?
crypt's user avatar
  • 2,397
5 votes
1 answer
919 views

How can I encrypt more than 128 bits of data with AES?

To my understanding a state is a $4 \times 4$ byte array used to store the plaintext. That equates to $128$ bits of data. To encrypt more than $128$ bits of data do I need to setup multiple of these ...
Champgoblem2's user avatar
0 votes
0 answers
45 views

Security of this parallelizable two-pass authentication scheme

This is only the authentication half of a block cipher mode of operation that provides authenticated encryption. The part that provides encryption is left out (it can be CBC, PCBC, ECB, or whatever). ...
Melab's user avatar
  • 3,645
0 votes
0 answers
248 views

How does "one-pass" authentication differ from "two-pass"?

The meaning of "one-pass authentication" as well as its difference from "two-pass authentication" has not been explained to my satisfaction. CCM mode, EAX mode, and HMAC are examples of the first type;...
Melab's user avatar
  • 3,645
6 votes
2 answers
4k views

Is the CBC mode of operation a stream cipher mode?

I am taking a class on security systems. My professor considers CBC to be a stream cipher mode, like CFB and OFB. Most sources I have read do not agree with this, so I asked my professor about this, ...
user avatar
2 votes
1 answer
560 views

Why is using an authenticated AES mode better for in-place data protection?

I always see people warning not to use unauthenticated modes of operation like CBC for AES . Why is that so ? I mean if you use AES-CBC with a random IV you will most likely secure your data . So for ...
Richard R. Matthews's user avatar
2 votes
1 answer
1k views

How does the TLS cipher suite DHE-RSA-AES128-CCM8 work without hashing algorithm

I came across cipher suites without hashing algorithm, when inspecting the mbedTLS (previously Polar SSL) TLS cipher suite list. For example: TLS-DHE-RSA-WITH-AES-128-CCM-8 (OpenSSL: DHE-RSA-AES128-...
SaAtomic's user avatar
  • 289
4 votes
2 answers
3k views

Security of CCM in TLS, in comparison to GCM, SHA or SHA2 for the digest

I've been looking into TLS cipher suites of OpenSSL and mbedTLS (previously called PolarSSL) and noticed that mbedTLS supports the CCM mode of operation (See list here), whereas OpenSSL does not. If I ...
SaAtomic's user avatar
  • 289
1 vote
2 answers
638 views

What role does the mode of operation play in Veracrypt vs. Bitlocker?

There is this VC vs Bitlocker debate . It is always about open source and not open source , alternative algorythms , portability , etc.... That is nothing new , but once I saw someone useing the mode ...
Richard R. Matthews's user avatar
0 votes
1 answer
1k views

Default mode of operation in TLS cipher suites

I've been trying to evaluate the security of a list of cipher suites and I've come across cipher suites, not explicitly featuring a mode of operation. Form this list (openvpn --show-tls), one of such ...
SaAtomic's user avatar
  • 289
1 vote
1 answer
208 views

Is there a block cipher mode that doesn't use the key input of the block cipher?

Is there a block cipher mode that does encryption and decryption without using the "key" input of the block cipher? I ask this because rekeying a block cipher can be an expensive process, and I ...
Daffy's user avatar
  • 2,379
2 votes
3 answers
286 views

Are there any deterministic multi-block encryption constructions that have an avalanche effect going both ways?

For common multi-block encryption schemes (CBC, CTR, CFB, stream ciphers, etc), if they are forced to be deterministic, a change in the plaintext will change only the current block and maybe future ...
Daffy's user avatar
  • 2,379
1 vote
2 answers
6k views

Brute force, get AES keys by multiple plain-texts with their cipher-texts

I know that the encryption is AES, and I have multiple plain-texts with their cipher-texts, I don't know the encryption mode (ECB, CFB, etc ...) actually, but I know that the keys and the IV Key (if ...
John Price's user avatar
2 votes
1 answer
263 views

Double-CBC as AES-KW Substitute?

Background. I'm trying to make a local command-line based password manager. So far, I've managed to make the output look dizzy on tty, and I plan to encode user credentials in individual 512-byte ...
DannyNiu's user avatar
  • 9,001
-1 votes
1 answer
3k views

Pros and Cons of Block Cipher's Mode of Operations?

What are the Pros and Cons of Block Cipher's Modes of Operations(ECB, CBC, CTR, OFB, CCM, GCM) in terms of Confidentiality Integrity CPA Restrictions on IV or Counter/Nonce Maximum number of Block ...
crypt's user avatar
  • 2,397
5 votes
1 answer
609 views

Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256?

I have a SoC with hardware AES-128 encryption, which is obviously quite efficient in terms of power usage and memory used. However, we would like to have AES-256 encryption (half for commercial ...
user1532080's user avatar
1 vote
2 answers
846 views

Number of cycles in cipher feedback mode (CFB)

How many cycles are there in a CFB mode of operation? Say for example I use AES encryption in CFB mode. How many times will this cycle before outputting the final ciphertext? In the picture below ...
user avatar
0 votes
1 answer
2k views

Cipher feedback mode with shift registrers

Can someone please explain to me how the Cipher Feedback Mode works? From what I have read some examples have a shift register in its explanation but some examples don't. Is there two versions of CFB ...
user avatar
10 votes
2 answers
3k views

Is CBC mode with a fixed IV secure, if a counter is prepended to the plaintext?

In this answer to an earlier, related question I noted that encrypting a nonce, such as a sequential counter, using the same block cipher and key as used for the message encryption itself is one of ...
Ilmari Karonen's user avatar
2 votes
1 answer
367 views

XEX mode - how to perturb the tweak

The first part of the classical description of XEX is $X = E_{k}(I) \otimes \alpha^j$ What I see a lot in sample code on the Internet is that you start with $T_ = E_{k}(I)$ and use that for the ...
nsayer's user avatar
  • 207
3 votes
2 answers
636 views

Is fixed key AES in counter mode a PRG?

I want to implement a PRG (Pseudorandom Generator). As AES is implemented in hardware, I am planning to use AES for efficiency. I am planning to use: $(AES_k(seed) \| AES_k(seed+1) \| AES_k(seed+2) \|...
satya's user avatar
  • 1,384
1 vote
1 answer
522 views

Security of deterministic encryption that uses CBC mode and plaintext as iv

As title, is this a safe deterministic encryption to use the second block of plaintext as IV, and encrypt with CBC mode? I am sure that the second block used as IV is different than the first block ...
Bobo Liao's user avatar
3 votes
2 answers
5k views

Modes of Triple DES - When to use each?

I'm studying for CISSP certification & am using Shon Harris Exam Guide. It states that there are 4 modes that Triple-DES can be used in: DES-EEE3 DES-EDE3 DES-EEE2 DES-EDE2 I understand these ...
Jo Bennet's user avatar
  • 131
8 votes
1 answer
167 views

Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

A paper published by Niels Furguson Collision attacks on OCB indicates that processing large amounts of data (somewhere on the order of $2^{32}$ 128-bit blocks) with a single encryption operation (...
K3rb3ros's user avatar
  • 143
10 votes
1 answer
3k views

CBC-Mode Infinite Garble Extension

A variation of the CBC mode is the Infinite Garble Extension. I can neither find a block diagram of it, nor the formulas for encryption and decryption. I would really like to learn more about it but ...
userkir's user avatar
  • 393
6 votes
1 answer
758 views

What is the best mode of operation for file encryption with Threefish512?

In Cryptography Engineering Bruce recommends using "rand IV CBC mode" but the copy of the book I have is from 2003 and I am unsure if this is still a recommended practice with all the recent attacks ...
K3rb3ros's user avatar
  • 143
3 votes
1 answer
479 views

AES in Counter mode for 64 bit input

I was reading how AES can be used for 64 bit data. Than i came to this answer :Is it possible to implement AES with a 64-bit I/O block size? The answer here is given that by running AES in counter ...
Infinity's user avatar
  • 575
1 vote
1 answer
641 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
AJB's user avatar
  • 121
8 votes
3 answers
1k views

Should I use “modes of operation” for a single block of data?

I am using AES to encrypt my data. I have only 128 bit block that I am encrypting using AES. I am using AES in CTR (counter) mode, since it is always to advisable to use block ciphers along with modes ...
Infinity's user avatar
  • 575
0 votes
1 answer
1k views

AES for 64 bit plaintext

I have a 64 bit plain-text that i want to encrypt using AES. But to use AES for 64 bit plain text i can either add padding bits to it or use AES in CTR stream mode. My question is which approach ...
Infinity's user avatar
  • 575
1 vote
3 answers
4k views

Pseudo code for CTR mode encryption

I am following a document here about CTR mode of encryption. I have some point uncleared. At the part 1 Review of Counter-Mode Encryption. Operation. To encrypt using CTR-mode encryption, one ...
Andiana's user avatar
  • 111
0 votes
1 answer
1k views

Use R-CTR (randomized counter mode) to compute MAC

I've read that in conjunction with CBC-MAC, R-CTR (randomized counter mode) can be used to compute a MAC, but why wouldn't you just use a block cipher in R-CTR on its own to compute a MAC?
user41194's user avatar
7 votes
2 answers
679 views

Is it feasable to combine ECB and CTR block modes of operation?

Both ECB and CTR block modes have advantages over other block modes. They both support parallel encryption and decryption and random reads/writes. Yet both have major disadvantages: (I'm assuming AES ...
Morten's user avatar
  • 71
2 votes
1 answer
3k views

Why do the majority of SSL cipher suite used CBC?

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM. Why is CBC most used? ...
Minaj's user avatar
  • 1,080
2 votes
1 answer
94 views

If using large keysizes, is McOE-X actually safe?

After reading the this question, I found the McOE mode of operation for tweakable block ciphers along with its "X" and "G" conversions for normal block ciphers. A quick research yielded the paper "A ...
SEJPM's user avatar
  • 45.7k
1 vote
2 answers
751 views

How effective is Serpent-256 in CTR mode?

I downloaded a compression program known as PeaZip which offers encryption and 2-way authentication also. PeaZip has an option to encrypt compressed file with variety of ciphers and one of them is ...
RPK's user avatar
  • 571
2 votes
1 answer
2k views

Repeated NONCE in CTR mode

My understanding is that, in CTR mode, the NONCE must be unique because, if a NONCE is reused, multiple plaintexts will be XORed with the same value and this gives an attacker leverage to decrypt the ...
Julian's user avatar
  • 23

1 2
3
4 5
7