Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
0 votes
1 answer
199 views

Is this block encryption scheme using PCBC for RSA secure?

I stumbled over this post, containing code to encrypt larger messages with RSA by splitting them into blocks using PCBC mode I will copy the relevant part here, but for details see the original ...
Josef's user avatar
  • 362
2 votes
2 answers
46 views

Is there a cipher that uses part of the already-computed ciphertext in the encryption scheme?

Are there any famous ciphers that, to determine the encrypted letter at position n in the ciphertext, it uses the encrypted letter at position n-1 in the ciphertext? I tried google but I couldn't ...
User's user avatar
  • 21
0 votes
1 answer
583 views

Does the Blowfish cipher work with OFB mode?

I'm trying to implement the Blowfish cipher in Output Feedback mode. OFB mode has two operations, XOR and the block cipher. XOR inputs two blocks of the same length and outputs one block of the same ...
54 69 6D's user avatar
  • 125
0 votes
2 answers
1k views

How do “modes of operation” with block ciphers like (eg) DES work?

When trying to understand how “modes of operation” are applied when using block ciphers like DES, I noticed I must be missing something. Maybe I simply misunderstood or mixed up things somewhere. ...
Vindula Jayawardana's user avatar
7 votes
2 answers
4k views

Should I use XTS or GCM to encrypt my hard drives?

I want to start encrypting all of my hard drives, but I don't know whether to choose XTS or GCM mode. Why is it that XTS is recommended (since the most websites I visit use GCM in their HTTPS ...
blacklight's user avatar
2 votes
2 answers
434 views

Can I use a block cipher in CTR mode to generate keys from a master key?

Suppose I have an AEAD mode based on a block cipher that requires two or more keys. In some cases, there is a complex proof that one key suffices. But finding such a proof is hard. An alternative ...
Demi's user avatar
  • 4,763
6 votes
1 answer
1k views

How many blocks can securely be encrypted with XTS

I could not find in the NIST recommendations on XTS how many blocks can securely be encrypted with XTS-AES. Through the recommendations, I've found: The length of the data unit for any instance of ...
berendeanicolae's user avatar
1 vote
2 answers
453 views

mode of operation in cryptography

We need to choose a mode of operation for a Telnet like application where the average message size is between 7 and 1024 bytes. What is the best mode of operation in this case? a. CBC b. CFB c. ...
priyanka's user avatar
3 votes
2 answers
939 views

Why can't we use the first block of AES-CBC as MAC

As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
root's user avatar
  • 141
2 votes
0 answers
525 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
Demi's user avatar
  • 4,763
2 votes
1 answer
122 views

security of a block cipher mode of operation

Consider the following block cipher mode of operation: \begin{align} tag_0 &= mac\:key\\ plaintext_0' &= plaintext_0 \oplus iv\\ E(tag_0 | plaintext_0') = C_0 &= tag_1 | ciphertext_0\\ E(...
Ella Rose's user avatar
  • 19.5k
4 votes
0 answers
239 views

How secure is $\operatorname{AES256}_{\operatorname{ECB}}(\operatorname{ChaCha20}(\text{plaintext}))$?

Suppose I encrypt a bytestream using ChaCha20, and then encrypt the resulting ciphertext using AES in ECB mode. How secure is the combination?
Demi's user avatar
  • 4,763
6 votes
2 answers
351 views

A block cipher whose key changes after each block

I have been reading about various block cipher modes of operation, and all of them seem to treat the block cipher (including it's key and key schedule) as a sort of immutable black box. I would like ...
BenGoldberg's user avatar
3 votes
1 answer
492 views

Are all self-synchronizing cryptosystems necessarily self-synchronizing stream ciphers?

I have a noisy communications link between two points that occasionally deletes a byte. By "self-synchronizing cryptosystem", I mean that the receiver attempting to recover the original plaintext ...
David Cary's user avatar
  • 5,594
5 votes
2 answers
849 views

How secure would hand ciphers be using a Block Cipher Mode?

I've been looking into different ciphers that require very minimal computation power (calculator, deck of cards, index cards and a pencil), i.e. hand ciphers. For the most part all methods typically ...
jecxjo's user avatar
  • 161
3 votes
2 answers
277 views

Should I use a self-designed Block Cipher Mode of Operation?

We all know we should NOT roll our self-designed encryption algorithm, how about block cipher mode with a certificated cipher method like AES? Will a self-designed block cipher mode cause any flaws or ...
Hartman's user avatar
  • 269
1 vote
0 answers
627 views

Is it possible to create a detection oracle for all block cipher modes? -- ciphertext-only cryptanalysis

I have made an ECB/CBC detection oracle, and am now trying to make a detection oracle that can differentiate between CBC/CFB/OFB/CTR/etc. I can already tell ECB apart from the others due to this ...
cremefraiche's user avatar
1 vote
0 answers
112 views

Reykeyed AES in CTR mode as a stream cipher

Suppose one uses AES in CTR mode to generate a keystream, but every $l$ bytes the $n$ bits that would follow are used as a new AES key. Assuming that AES is a secure PRP: Is this a secure stream ...
Demi's user avatar
  • 4,763
1 vote
1 answer
76 views

What information about the ciphertext can an attacker discern if a key is used too many times?

Suppose that I use Blowfish or XTEA (both secure block ciphers with 64-bit block size) in CTR mode. In these cases, I need to change the key after $2^{16}$ blocks to avoid leaking information with ...
Demi's user avatar
  • 4,763
1 vote
2 answers
153 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
Demi's user avatar
  • 4,763
5 votes
1 answer
336 views

Block cipher mode of operation with beyond-birthday-bound security

I am looking for block cipher modes of operation that are secure even when the number of blocks encrypted exceeds the birthday bound.
Demi's user avatar
  • 4,763
1 vote
3 answers
279 views

Security of a parallelizable block cipher mode

This is the scheme of a parallelizable block cipher mode of operation: $IV$ is the initialization vector. $BN$ is the zero-based index number of a block in a stream of data. $BT$ is the tweak that is ...
Melab's user avatar
  • 3,645
5 votes
1 answer
377 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
Sky Passaro's user avatar
1 vote
1 answer
583 views

Is super encryption (aka “multiple encryption”) always good?

I'm trying to use super encryption (also known as “multiple encryption”) with AES in CFB mode with IV and password salting and AES in CTR mode both without padding. I first use AES CFB and then AES in ...
Dhruva's user avatar
  • 125
2 votes
1 answer
250 views

Is it secure to encrypt random key with block cipher in ECB mode?

If we have a random key $K$ which is 256-bit, and have a block cipher $C$ which has a block size of 128-bit. Is it safe to encrypt $K$ with $C$ in ECB mode? This problem can be generalized to given a ...
Haochen Xie's user avatar
0 votes
1 answer
2k views

what problem happen if we always use IV Zero in CBC Mode? [duplicate]

i have a question about CBC operating mode. what problem happen if we always use IV Zero in CBC Mode?
Mahsa ehsani's user avatar
6 votes
2 answers
386 views

Should Increment functions be near-constant time?

When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" ...
user avatar
7 votes
1 answer
258 views

KFB mode - key feedback

Please, could someone explain to me how the Key feedback mode (KFB) mode works and what the IV in output block stands for? And what properties does the "constant input" has to provide? Should it be ...
DLx's user avatar
  • 111
4 votes
1 answer
4k views

Single bit error in CBC

Why does a single bit error when using the CBC block cipher mode of operation affect the decryption of a block (Oj) with a probabilty of 50%? And in the following block, why is the one bit error in ...
DLx's user avatar
  • 111
3 votes
0 answers
100 views

Unknown authenticated encryption mode

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way: a unique 128-bit key is used; the plaintext ...
dots's user avatar
  • 31
5 votes
2 answers
2k views

Secure method for encrypting 32 byte private keys

I am using 32 byte EC private keys on the client side of a web application. These keys should be securely stored on a server database. The keys should be encrypted (AES) before being sent to the ...
Matthew Mitchell's user avatar
2 votes
1 answer
454 views

Subkey generation in OMAC1/CMAC with XTEA?

All implementations of CMAC that I have found so far use a block cipher with the same key and block size. However, XTEA enciphers a 64 bit block by using a 128 bit key. If ...
limond's user avatar
  • 23
9 votes
1 answer
3k views

Effect of ESSIV when used with XTS

I looked everywhere on the web and I did find a lot of information about full disk encryption, but nothing really answered my question. When formatting a partition to use LUKS, the two most common ...
JoeyBF's user avatar
  • 193
7 votes
1 answer
15k views

Precisely how does CBC mode use the initialization vector? [duplicate]

As I understand it, AES in CBC mode does an XOR of the 128-bit initialization vector and the first 128 bits of plain text. Is this correct? I am using the PHP 5.3 openssl extension in aes-256-cbc ...
Edward Barnard's user avatar
7 votes
1 answer
1k views

Where is CFB-MAC defined?

I can find descriptions of using CFB mode to create a MAC and even implementations, but cannot find any standard or papers analyzing its security bounds. Is there a standard for CFB-MAC? Where can I ...
otus's user avatar
  • 32k
22 votes
2 answers
4k views

Is (AES-)GCM parallelizable?

I recentely faced the issue of random access decryption while AES-GCM was being used. I said this person that the underlying CTR should allow parallelization but I have no idea how authentication ...
SEJPM's user avatar
  • 45.7k
9 votes
1 answer
2k views

What are the constraints on using GCM with a tag size of 96 and 128 bits?

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST SP ...
Maarten Bodewes's user avatar
  • 91.9k
4 votes
2 answers
2k views

Implementing CBC Encryption Using Decryption

I've implemented this algorithm, which, working from the end of the message backwards, creates a valid CBC ciphertext from any plaintext, using the block cipher's decryption operation instead of the ...
Z.T.'s user avatar
  • 814
2 votes
0 answers
57 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
SEJPM's user avatar
  • 45.7k
5 votes
1 answer
991 views

Parallelization of CFB mode encryption and decryption

While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand: Regarding whether CFB ...
otus's user avatar
  • 32k
2 votes
2 answers
11k views

What are the advantages of using OFB (Output Feedback Mode)? [closed]

I have a problem with OFB mode, because I have heard that it is stronger than CFB.
kandege rajika's user avatar
3 votes
1 answer
446 views

Does XTS provide random write access?

I'm trying to find a sufficient encryption mode that supports random read and write access. It seems like XTS is a perfect fit, since in my use case authentication and integrity insurance are handled ...
elisae__'s user avatar
7 votes
2 answers
574 views

Turning a 64 bit block cipher into a 128 bit block cipher

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical. ...
Maarten Bodewes's user avatar
  • 91.9k
0 votes
1 answer
2k views

Why using AES in ECB (Electronic Code Book) mode a bad idea? [duplicate]

Why using AES in ECB (Electronic Code Book) mode a bad idea? is CTR mode better? Given only these two can be used for parallelization.
tony9099's user avatar
  • 323
0 votes
2 answers
2k views

Operation modes of block ciphers how are used?

I am studying about different operation modes of block ciphers my question isn't something specific to that, but is how these operation modes are used in cryptography? I have this picture here (OFB-...
Dr. Cryptography's user avatar
4 votes
2 answers
537 views

Is it practical to use a stream cipher in a block cipher mode?

My idea is to use a stream cipher encrypting 16 bytes at a time as a primative block cipher in a mode of operation such as CBC mode. Is this practical or useful in any way?
Daffy's user avatar
  • 2,379
5 votes
2 answers
1k views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
Paya's user avatar
  • 189
3 votes
1 answer
948 views

Is MCrypt's 8-bit OFB mode secure?

I just stumbled across a Stack Overflow post which points out that the libmcrypt library (notably used in PHP) implements a somewhat unusual set of block cipher modes: it calls the usual CFB and OFB ...
Ilmari Karonen's user avatar
0 votes
1 answer
118 views

Are modes of operation algorithms practical?

I took a cryptography class back in college, and now that I am working my 1st career one of the things currently on my plate is coming up with an algorithm to encrypt data before it's placed on the ...
erp's user avatar
  • 111
2 votes
1 answer
3k views

About the Security of PCBC Encryption Mode

We are designing an encrypted file system. We plan to use the PCBC (Plaintext Cipher Block Chaining) encryption mode for encryption. This is because we desire the feature ("small changes in the ...
Jingwei's user avatar
  • 169

1 2 3
4
5
7