Hot answers tagged

11 votes
Accepted

On what Galois field AES really works?

No, in AES the $a_i$ are not bytes. They are bits. The 8 bits $a_i$ together form a byte, and are considered a single element of the Galois Field ${\operatorname{GF}\left(2^8\right)}$, also noted $\...
user avatar
  • 122k
4 votes

On what Galois field AES really works?

You can see an algebraists view of AES at in a document written by H. W. Lenstra. There is also the more detailed The Design of Rijndael document by the designers at Daemen's homepage. Specifically ...
user avatar
  • 16.1k
3 votes

AES CBC: When to use new IV

It's probably unwise to let the other participant to choose your IV. If nothing else the attacker could force IV reuse. More commonly, challenge and response schemes put the challenge inside the ...
user avatar
3 votes
Accepted

Generalizing AES s-box circular shifts in bigger GF

OK, the left vs right shift issue has to do with if the variable is represented by "big-endian" or "little-endian" convention, i.e., if the Least Significant Bit is on the left or ...
user avatar
  • 16.1k
2 votes

Is this AES GCM + asymmetric schema secure?

NaCL provides a set of crypto_box methods which do this all in one go. Libsodium provides an even easier set of crypto_box_easy ...
user avatar
2 votes
Accepted

Validating AES GCM authentication tag between two different implementations

Yes, the authentication tag is specified fully in the GCM specifications. Where it is placed is otherwise inconsequential - the location doesn't influence the values of the bits of the authentication ...
user avatar
  • 84.5k
2 votes
Accepted

How do I find an equivalent permutation of AES S-box which sends $0$ in $0$?

If you use $\tilde S(X)=S(X)\oplus 0x63$ (i.e. if you XOR 0x63 onto every S-box output, you will have the desired function. This is because the AES S-box is defined as the composition of the $GF(256)$ ...
user avatar
  • 9,596
2 votes

What is the difference between AES-CCM8 mode and AES-CCM mode?

8 is the tag length (in bytes). CCM is a family of AEAD (authenticated encryption with associated data) algorithms which is parametrized by: a block cipher algorithm (e.g. AES-128, AES-192, AES-256, ...
user avatar
2 votes

How to create a key for AES in a 192 bit key length from a password?

Lets say that I have a password. And it's secure. But it's a 10 character string. If we assume all of the 10 characters are ASCII ( not extended) you will get at most 64-bit search space for the ...
user avatar
  • 43k
2 votes

AES CBC: When to use new IV

If you don't have a secure channel, then you can't trust the IV that the other side is sending you, because an attacker could well tamper with it. Even if you do have a secure channel, the other side ...
user avatar
  • 1,547
1 vote

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Let's assume that we want to increase the lifetime of the master key. Can we do this by adding a key derivation step before the actual encryption? Assuming that we use the master key as input keying ...
user avatar
  • 84.5k
1 vote

What is the difference between AES-CCM8 mode and AES-CCM mode?

As defined in section 6.1 of RFC6655, AES-CCM8 differs in that the size of the authentication tag is 8 bytes (i.e. 64-bits) rather than 16 bytes (i.e. 128-bits) for AES-CCM. The NIST CCM specification ...
user avatar
  • 9,596
1 vote

Generalizing AES s-box circular shifts in bigger GF

There something misleading in Wikipedia article. They wrote: $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll 3) \oplus (b \lll 4)$ Is equal to: $s = b \times 31 \mod 257$ where $\times$ is ...
user avatar
  • 827
1 vote

Decryption considering AES OFB and ECB

Unless I am misunderstanding your pseudo code there is a way to obtain session key without knowing the master key from keyBlob and ivBlob if the iv used in ivBlob and keyBlob are the same (make sure ...
user avatar
1 vote

What can an attacker do with this in-secure usage of AES-CFB8?

If the key and IV are identical then the first intermediate value after the block encrypt that is XOR'ed with the first byte is also identical between two encryption operations. That means that if the ...
user avatar
  • 84.5k
1 vote

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

It depends entirely on how strong the password is. 100,000 rounds of PBKDF2 for a password with a given hash adds the equivalent of $\log_2(100000) \approx 16.6$ bits of entropy compared to a single ...
user avatar
  • 12.9k

Only top scored, non community-wiki answers of a minimum length are eligible