Questions tagged [modes-of-operation]
ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.
327
questions
2
votes
3
answers
5k
views
Which attacks can be avoided by the use of OFB instead of ECB?
For a file encryption program, I was told to use Output Feedback mode (OFB) instead of ECB (Electronic code book) mode.
Which attacks can I avoid by this choice?
- 1,727
1
vote
2
answers
1k
views
Complexity of ECB and OFB
What is the complexity of ECB in terms of Time and Memory?
and also in OFB? I can't find it in the internet, so I decided to ask it in here.
- 1,727
2
votes
1
answer
3k
views
How does Output Feedback mode use the initialization vector?
How can I process Initialization Vector inside the Block Cipher Encryption box (using for example AES) together with the Key?
Will I encrypt the Initialization Vector like a block of plaintext?
So I ...
- 1,727
9
votes
2
answers
35k
views
Cipher Feedback Mode
I can't understand what CFB really is. It said in Wikipedia that CFB is same as CBC, but I find that CFB is more difficult than CBC.
Can someone explain to me how CFB works. Such as how ...
- 1,727
12
votes
1
answer
4k
views
Deterministic nonces in CTR mode
I want to encrypt a file with AES in CTR mode. I have a 256 bit master key and the file. Given these, the encryption must be deterministic, so I can't use a random nonce in the usual way. Fortunately ...
- 24.8k
4
votes
1
answer
548
views
What "Tag Length" should be used for the EAX MAC?
Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
- 637
91
votes
2
answers
170k
views
What is the difference between CBC and GCM mode?
I am trying to learn more about GCM mode and how it differs from CBC. I already know that GCM provides a MAC, which is used for message authentication. From what I have read and from the code snippets ...
- 1,273
7
votes
3
answers
1k
views
CBC - a canonical mode, even though there are streaming modes
Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
- 255
5
votes
3
answers
12k
views
Which one of the Block Cipher modes is the best?
I have two questions regarding the Block Cipher Modes:
Which one of the modes is considered the best?
I know CBC has a problem of IV since the next block of the plain text is XORed with the result of ...
- 241
24
votes
1
answer
6k
views
(Why) should I avoid using a randomized IV for CTR mode?
I'm currently reading the chapter of Cryptographic Engineering (Ferguson, Schneier, Kohno 2010) about block cipher modes of operation. They have recommended CBC with random IV instead of CTR due to ...
- 1
4
votes
1
answer
491
views
Undecrypt using the OpenSSL EVP API?
I'm writing a client-server encryption scheme for homework, and I've stumbled upon what might be a fatal blow to my current implementation.
When using AES-256-CBC on the two sides, it's important ...
- 141
3
votes
1
answer
1k
views
OCB - brute force against unknown IV
I read that brute force attacks against a plaintext encrypted in OCB with unknown key and IV has approximately the same complexity as an attack where only the key is unknown.
Why is that?
Is there a ...
- 33
11
votes
1
answer
10k
views
Does AES-CTR require an IV for any purpose other than distinguishing identical inputs?
I'd like to encrypt files deterministically, such that any users encrypting the same plaintext will use the same key and end up with the same ciphertext. The ciphertext should be private as long as ...
- 1
4
votes
2
answers
667
views
Does this block cipher mode allow for decryption?
Is there's a way for someone (with the key) to decrypt a message encrypted with the cipher mode shown?
$$ P_0 = IV $$
$$ C_i = P_{i-1} \oplus E_K(P_i) \oplus P_i $$
- 205
6
votes
2
answers
928
views
Is it safe to store initial counter value for AES-CTR alongside with ciphertext?
The initial counter value can actually be thought of as a sort of IV, which I assume is safe to transmit with the ciphertext, but I really want to be sure that this is indeed safe.
- 205
12
votes
3
answers
3k
views
Using a Non-Random IV with modes other than CBC
The weakness CWE-329 is an interesting problem with CBC mode. However, does this same weakness affect the other modes of operation that rely upon an IV such as: PCBC, CFB and OFB? My gut feeling is, ...
- 1,486
20
votes
4
answers
21k
views
Can CBC ciphertext be decrypted if the key is known, but the IV not?
Let's say that there is a binary file encrypted with AES in CBC mode (i.e. using a key and initialization vector). If key is known, but IV is not, is it easy to fully decrypt the file?
How hard is it?...
- 365
33
votes
2
answers
14k
views
Why do we need special key-wrap algorithms?
Wikipedia says:
Key Wrap constructions are a class of symmetric encryption algorithms designed to
encapsulate (encrypt) cryptographic key material.
We are using these algorithms to encrypt (and ...
- 22.5k
3
votes
2
answers
2k
views
How can I encrypt more than 64 bit with the Data Encryption Standard?
The Data Encryption Algorithm is designed to encipher and decipher blocks of data consisting of 64 bits under control of a 56-bit key.
If my data is more than 64 bits, (suppose 66 or 67 bits), will ...
15
votes
3
answers
2k
views
Is the CBC weakness in XML Encryption a new discovery? Are other applications vulnerable?
The RUB in Germany reports that XML encryption is broken. This is essentially the W3C standard for protecting XML documents from prying eyes.
Does this mean that an attacker can only see a single ...
- 2,601
15
votes
2
answers
22k
views
AES in ECB mode weakness
In a project that I'm currently working on, we are encrypting some data using AES with ECB mode in a database. Each piece of data being encrypted is very small, no more than 10 characters long.
Very ...
- 253
20
votes
1
answer
3k
views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
- 775
6
votes
3
answers
3k
views
What is the likely cause the RSA algorithm gives back plain text in this case?
Text book question of Chapter 9 of "Crypto and Network Security" by William Stallings:
When using the RSA Algorithm — if a small number of repeated encodings give back the plain text, what is the ...
- 6,134
15
votes
2
answers
2k
views
Is CBC really dead?
I developed a p2p-app in C# which sends and receives encrypted text messages (50kB). For encryption, my app uses 128-bit AES in CBC cipher mode. For each message it uses a new randomly-generated IV.
...
- 315
60
votes
3
answers
13k
views
Hashing or encrypting twice to increase security?
Over on the bitcoin forums I asked why the bitcoin client computes SHA-256(SHA-256(x)) as its cryptographic hash for a variety of purposes. The leading theory--since the bitcoin author has disappeared-...
- 701
83
votes
9
answers
137k
views
Should I use ECB or CBC encryption mode for my block cipher?
Can someone tell me which mode out of ECB and CBC is better, and how to decide which mode to use? Are there any other modes which are better?
- 1,151
10
votes
1
answer
8k
views
What are the details of the DES weakness of reusing the same IV in CBC mode with the same key?
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key.
How serious is this weakness?
Also, is AES less effected ...
