Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
327
questions
0
votes
1
answer
1k
views
Block cipher mode with diffusion on ciphertext
As I understand, diffusion property in AES-CBC ensures that one-bit change in plaintext will yield changes in all following blocks in ciphertext upon encryption.
I'm looking for algorithm that will ...
- 103
2
votes
1
answer
670
views
Why are modes of operation used, what attacks do they prevent?
I know you always need to use a mode of operation when using a block cipher, AES for example, and Wikipedia has a good explanation for what modes of operation are
Now I know if i do not use a mode of ...
- 966
3
votes
1
answer
421
views
Can IGE mode be parallelized?
As far as I know, in IGE mode (infinite garble extension) each block depends on the previous one.
In that case, can the encryption be parallelized? Is there some way to do it?
- 131
4
votes
1
answer
361
views
How does CTR-ESSIV work?
I'm using Wikipedia and Handbook of Applied Cryptography as references. I know that ESSIV generates an initialization vector (IV) by combining a hashed key with the sector number.
However, I only see ...
- 41
0
votes
2
answers
472
views
Counter Mode with a sequence of zeros bits plaintext, is it secure?
I had a quiz last week in computer security course. There was a confusing question that I am still looking for a good and clear answer.
First, I know that counter mode with a good block cipher is ...
1
vote
1
answer
189
views
With wrong IV at receiver side, the CFB in better than OFB?
Assume the receiver have a wrong IV (initialization vector), in the CFB mode only the first block of plaintext is wrong but in OFB mode the second and all blocks will be affected.
Is that correct? ...
- 177
5
votes
3
answers
3k
views
Why isn't CTR mode (counter mode) used more often?
For the CTR mode, the design is good for parallelization, yes, it seems the benchmark of the program downloaded from crypto++ proves that on an Intel I7 CPU.
My question is that as most of CPU on ...
- 177
1
vote
2
answers
871
views
The perfect way of using IV in CTR mode
I understand that it is necessary to use the same IV for both encryption and decryption in the CTR mode. I'm thinking about the case when I concatenate the secret ...
- 111
-1
votes
1
answer
367
views
Which block cipher mode does the experts use? [closed]
I want to know which "block cipher mode of operation" does the experts use?
I don't want to use ECB or CBC because add padding and padding mess up my code. So which one does the experts use.
/Thanks
- 563
5
votes
2
answers
5k
views
Encryption for a short packet size
I have an 8051 microcontroller with a radio that can send packets with up to 32 bytes and I want to have the messages encrypted. It is a sensor network so I really only want to send one packet per ...
- 153
5
votes
1
answer
1k
views
Why are there no MACs inspired by block cipher modes other than CBC and CFB?
I've been studying message authentication codes and I was wondering why a MAC can only be produced with AES in CBC and CFB mode and why not the other modes such as ECB, OFB and counter.
Why are CBC ...
- 83
-2
votes
1
answer
158
views
Which Block cipher mode should I use? [closed]
Which of the Block cipher mode is MOST secure? I dont care about the performance just the most secure
- 563
10
votes
1
answer
1k
views
Why is authenticated CFB mode insecure?
I read that the following adaptation of the CFB block cipher mode into an authenticated mode is prone to chosen plaintext attacks, yet Im still unsure how to prove it:
Let $P_1,P_2,\ldots P_n$ be the ...
- 417
4
votes
1
answer
828
views
Modes of encryption for hard drives?
What are the currently recommended modes of encryption for large disks? Basic requirements would seem to be that you can update an encrypted sector independently of others, which rules out most ...
- 375
3
votes
1
answer
1k
views
What is the use of segments in Cipher Feedback Mode (CFB)
In NIST SP800-38A: Recommendation for Block Cipher Modes of Operation
CFB can be used with a parameter s - the size of a data segment in bits - which determines the ...
- 91.9k
2
votes
3
answers
1k
views
Does AES CTR mode store header information in encrypted files?
According to the movable-type.co.uk website,
In the ‘counter mode’ used in this implementation, a counter which changes with each block is first encrypted, and the result is bitwise xor’d with the ...
- 538
6
votes
3
answers
2k
views
Is there any area where AES-CBC cannot be used ? If so, why?
I would like to know the domains or specific applications where using AES-CBC is not advised due to any drawbacks like sequential encryption of AES-CBC ?
- 471
1
vote
2
answers
494
views
Random vs. Fixed Paddings
Is there any consensus (i.e. are there any research results) on the benefits and drawbacks of various padding schemes?
Generally there seem to be two kinds of them:
random paddings, like ISO10126 ...
- 637
1
vote
1
answer
2k
views
Modes of operation for Public Key Encryption schemes
Symmetric key encryption schemes have well defined modes of operations for achieving deterministic (ECB) or Randomized (CBC, OFB, CTR ) etc. and other applications of the same. But are they defined ...
- 6,134
4
votes
1
answer
162
views
Authenticating Very Short (Sub-Block) Data
If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)?
...
- 637
5
votes
1
answer
514
views
GCM: Math behind update of AAD after ciphertext has been processed
In the Bouncy Castle libraries, the GCM cipher implementation has an interesting property that does not seem described in the GCM papers (neither the NIST or the original paper):
Some AAD was sent ...
- 91.9k
3
votes
1
answer
5k
views
How can AES be considered secure when encrypting large files?
Why is AES considered to be secure when encrypting large files since the algorithm is a block cipher?
I mean, if the file is larger than the block size, the file will be broken down to fit the blocks....
- 165
4
votes
2
answers
2k
views
AES-ECB as an authentication mechanism
ECB is considered to be insecure when used for confidentiality because identical plaintext result with identical ciphertext. But what if we use ECB for authentication?
Assume A wants to transmit an ...
- 736
7
votes
2
answers
3k
views
Choice of authenticated encryption mode for whole messages
There are several well-regarded block cipher modes for authenticated encryption which have made their way into standards and protocols: CCM, EAX, GCM, OCB, …
If I am designing a new messaging or ...
7
votes
2
answers
2k
views
OCB and GCM security
Is OCB as secure as GCM or CCM ?
Since OCB design is quite different from GCM and CCM, I was wondering if the security properties of these latters are satisfied by OCB, as well.
- 2,837
3
votes
1
answer
373
views
Is any specific packet cipher mode to be prefered for use with – for example – UDP?
Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order ...
4
votes
1
answer
221
views
What's the consequence of having a short IV? Is one mode better in that case?
I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
- 43
3
votes
1
answer
227
views
Construct block cipher from a smaller one with mixing function
I read about the AEZ encryption scheme as presented at the CAESAR competition. To me it seems like a construction of an arbitrary length block cipher from a smaller one. The key component is the ...
- 251
4
votes
2
answers
5k
views
How to encrypt a file for random access
I am a programmer familiar with C/C++ and Python. Lately, we got an assignment from a team asking us to work on one of their projects: we need to make a small program to encrypt a large file using ...
- 43
6
votes
1
answer
217
views
Streaming mode of operation that is more resistant against nonce reuse
Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality?
In this question it would be allowed for the streaming mode to leak if ciphertexts ...
- 91.9k
8
votes
2
answers
3k
views
How do we compute IV+1 in CTR mode?
This may be a very simple question, but I have not found info about this in any place. My question is about CTR mode: When it says $IV+1$… How do we make this operation?
For example, if I have the IV ...
- 3,922
19
votes
3
answers
11k
views
Modes of operation that allow padding oracle attacks
It seems to me that padding oracle attacks are mainly a concern for users of CBC mode encryption. Question: are any other modes of operation vulnerable to padding oracle attacks? And if so, why?
...
- 91.9k
3
votes
1
answer
439
views
Galois field step in XEX mode
I'm reading through the XEX mode spec, and I want to make sure I've understood the $\alpha^j$ step correctly:
$X = E_K(I) \oplus \alpha^j$
$C = E_K(M \oplus X) \oplus X$
where:
$M$ is the ...
- 3,527
4
votes
1
answer
322
views
How do I decide what mode to use?
I'll be using AES from OpenSSL. I understand why I don't want to use ECB from reading pages like this Wikipedia article, which has a great example of what happens when you attempt to encrypt with ...
- 143
1
vote
1
answer
191
views
Modes of Operations Exercise
I am currently stuck at an exercise for my Cryptography Class in University which is:
Alice wants to send a message $M = (M_1,M_2) =$ "Pay Bob \$100 from bank accout $12345$" to her bank (encrypted). ...
- 111
3
votes
2
answers
459
views
How do I construct variable length input (VIL) in a block cipher mode?
I've just been skimming NIST's "Five Confidentiality Modes". I understand those block cipher modes are used to securely encrypt input longer that the block cipher length. However, the common block ...
- 133
9
votes
1
answer
11k
views
Error propagation in CBC mode
Going through the wiki for modes of operation I see that the section error propagation says that an error in one block in the ciphertext in CBC mode only impacts two blocks. I do not quite get that. ...
- 861
13
votes
3
answers
15k
views
Difference between a nonce and IV
I know the generic difference between a nonce and an IV. I am specifically looking for a clarification on these terms as used in the "Evaluation of Some Blockcipher Modes of Operation" by Phil Rogaway....
- 861
1
vote
1
answer
307
views
Does not using padding mean a lack of security?
I've read several texts which say that if the entire plaintext is a multiple of the block-size padding is not required (and not using padding would not mean a loss of security).
I generally disagree ...
- 508
3
votes
1
answer
1k
views
Can XEX or XTS modes be used with only one tweak?
XEX Mode (with two tweaks) is the following scheme:
$X = E_{k}(I) \otimes \alpha^j \\
C = E_{K}(P \oplus X) \oplus X$
where $I$ and $j$ are both tweaks (sector number and block number respectively). ...
- 265
7
votes
2
answers
9k
views
Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
In Chapter 6, Question 6.8, of his book “Cryptography and Network Security Principles and Practices”, William Stalling asks:
Why do some block cipher modes of operation only use encryption while ...
- 71
3
votes
1
answer
2k
views
Difference between plain AES CTR and "CCM-style" CTR
I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
- 523
2
votes
1
answer
585
views
Encryption mode with chained algorithms
Suppose that I want to encrypt some data using two different algorithm chained (e.g. AES and Serpent) and harnessing the benefits of CBC.
I can do:
...
- 121
4
votes
2
answers
926
views
Authenticated encryption without padding
I want to encrypt data and protect its integrity and confidentiality. However, I cannot increase the length of the data.
Are there any cipher modes of operation which provide confidentiality and ...
- 125
9
votes
2
answers
2k
views
Why does CTR mode XOR the plaintext into the output of the block cipher rather than XORing the plaintext into the input of the block cipher?
As I understand it, CTR mode essentially turns a block cipher into a stream cipher like so:
...
- 193
18
votes
1
answer
12k
views
GCM vs CTR+HMAC tradeoffs
So these days I see everyone using AES-GCM. What are its advantages over simple CTR+HMAC modes? Is it speed? Or ciphertext length? And what are the security tradeoffs, both in terms of practical ...
- 281
1
vote
1
answer
343
views
Compared to GCM or XTS modes, how secure is H xor R1, E (R2, R1, Message) for confidentiality and integrity?
Let R1 and R2 be (32 byte) random values, and let a H = Hash (R1, R2, Message) be of the same length as each R value. Provided E (R2, R1, Message) is operating in some chaining mode, are there any ...
- 111
2
votes
2
answers
3k
views
IV/Nonce in CTR&GCM mode of operation
We know reusing IV can compromise our secrecy. I have some questions aiming to clarify the use of an IV/Nonce in CTR/GCM:
Is it OK to use the same key for encrypting plain-texts in authenticated ...
- 29
3
votes
1
answer
174
views
Block Cipher Mode Amicable to Fast Key Change/Rotation Like XOR?
I'm working with documents encrypted in long term storage. When a client requests the document, the document should be delivered encrypted under a distinct key (distinct from the long term storage key)...
user10496
38
votes
2
answers
23k
views
Why should I use Authenticated Encryption instead of just encryption?
There are various different modes of operation for block cipher use, some of which provide "encryption" and some of which provide authenticated encryption.
Why should I use an authenticated ...
- 4,297