Hot answers tagged

7

It looks like those are just precalculated tables for multiplication by the constants 2, 3, 9, 11, 13 and 14 in the AES finite field. We already have several questions about how multiplication in finite fields in general, and in the AES representation of GF(28) specifically, is done, such as: Galois fields in cryptography How is multiplication in field $GF(...


7

Yes, all modern symmetric ciphers strife to offer (approximately) x bits of key strength for an x-bit key size, just like AES. If they don't, we presume they are broken. Although there have been attacks on Salsa / ChaCha using fewer rounds, it doesn't seem that any attack has reduced the bit strength of the full cipher. Furthermore, differential ...


6

Is the above way reasonable (if we cannot find a proper implementation)? No, there are currently no such code-obfuscation algorithms that securely obfuscate code to a point where it's very hard to reverse engineer it. Please recommend any mature WBC implementations (not broken yet) I'm not aware of any WBC implementations for AES. Note, that a ...


6

Attacks on a cryptosystem with a 128-bit key are often much cheaper than $2^{128}$. If you have the strings $\operatorname{AES}_{k_1}(812738)$, $\operatorname{AES}_{k_2}(812738)$, $\dots$, $\operatorname{AES}_{k_{1000000}}(812738)$, it costs only about $2^{128}/1000000 \approx 2^{108}$ AES evaluations to find one of the $k_i$ keys—and an attack on a batch ...


3

In AES-CTR, the ‘IV’ and ‘counter’ are different concepts. To encrypt a message, you specify a nonce, like a message sequence number—sometimes called an ‘IV’. The nonce is usually 64 or 96 bits, but it could be anywhere from 0 to 128 bits long. For security, you must never reuse a nonce with a key. The length of the nonce for the particular AES-CTR ...


3

The calculations of mul2, mul3, mul9, mul11, mul13 and mul14 tables is based on multiplying each byte from 0 to 255 with 2 (for mul2) and so on for others. This is galois field multiplication using irreducible polynomial ( $𝑥^8+𝑥^4+𝑥^3+𝑥+1$). mult2 is xtime (macro) in AES source code: #include <stdio.h> #define xtime(x) ((x<<1) ^ (((...


3

There is no minimal message size. Even an empty message can be securely encrypted, i.e. the ciphertext is indistinguishable from a different encrypted message, as long as the encryption key remains secret. Can you describe exactly what are want to achieve? Where will the secret key come from? Even though minor optimizations are possible with very short ...


3

The term for the parameter to AES-GCM that must be unique from message to message for any single key is sometimes called ‘nonce’ and sometimes called ‘IV’. The security contract for AES-GCM requires that only that this never be repeated, and so it is appropriate to call it a nonce, meaning number used once. In contrast, for, e.g., AES-CBC, there is a ...


2

Yes, in fact it is quite simple. You are looking at the round subkeys for what is called the equivalent inverse cipher. The decryption round subkeys are generated by performing the InverseMixColumns operation on the encryption round key, the exact same operation used by the decryption function. The code you posted uses a series of byte table lookups (U1 to ...


2

OpenSSL cli doesn't support authenticated encryption modes like CCM and GCM. The reason behind that is the lack of security if the IV/nonce is reused. Using OpenSSL cli, IV management totally rely on the user, who tend to make mistakes... In order to avoid catastrophic failures, they simply decided to not allow AEAD. I guess the easiest way is to do a ...


2

where K depends only on the round keys (we can compute its exact expression) in order to solve a linear system, but it seems really grueling Actually, it doesn't look bad at all; that's 128 linear equations in 128 variables (over $GF(2)$); Gaussian elimination should be able to give you an answer in $128^3 \approx. 2,000,000$ bit operations; hardly ...


2

Adding software obfuscation to the standard white-box designs is close to what it is already done in the industry. This solution is not strong enough, it can be somewhat useful to make reverse engineering harder and make the attacker spend a longer time to fully understand the underlying design but does not avoid the key extraction. Software obfuscation, ...


1

Yes. The number of $n$-bit blocks you can encrypt with this construction is proportional to $2^n$ instead of just $2^{n/2}$. So for AES this shouldn't be a problem because you can't process anything near $2^{128}$ blocks. A secure stream cipher can be constructed from a PRF using something similar to AES-CTR. AES is more accurately described as a PRP than ...


1

No, the AES key is protected by the AES block cipher at all times. Only if the block cipher itself gets broken, if the implementation of the block cipher leaks data (though side channel attacks) or if the key is otherwise leaked can the key be retrieved by an adversary. Actually, even if the adversary dictates which plaintext is encrypted, the cipher should ...


1

What they are referring to as a mixing bijection is the MixColumns step of the AES round function. It functions to improve diffusion by reversibly scrambling the state of each column. Recall that the block state consists of a 4x4 matrix of byte-sized elements (totaling 16 bytes, or 128 bits), so each of the four columns are composed of four vertical elements....


1

Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption. yes, this is correct. you need two different sets of tables to implement the encryption and the ...


1

Does it use KDF (key Derivation function)? If yes, then is the KDF capable of decreasing the size of bits too? ...how is DES able to convert this (80 bit) key into a 64 bit one? AES and DES do not perform this task. The specification states that AES uses two sequence of 128 bits as input. "key" means "cryptographically strong bits". Something like ...


1

Each byte represents an element of a the finite field $\mathbf F_{256}$ with modulus $x^8 + x^4 + x^3 + x + 1$. For example, the byte $0x0e$ correspond to the polynomial $x^3 + x^2 + x$. Each coefficient of the polynomials are either 0 or 1. When you multiply two polynomials, we can always reduce by the modulus, so we end up with a polynomial of degree at ...


1

What do you expect to generate the overflow error? The AES function certainly doesn't know about the way you construct the 16 byte cleartext block. AES-CTR is usually done with 64 bits of nonce and 64 bits of counter, so it will overflow much sooner, after $ 2^{64} - 1 $. The counter value will either wrap around, or raise an error / throw an exception, or ...


1

Diffie-Hellman gives you a shared secret. Something like CBC + HMAC needs a key for the block cipher and a key for the MAC. CTR + HMAC would need a key for the block cipher and a key for the MAC. An AEAD needs a key. These parameters are usually needed twice: one set for transmit (tx) and one set for receive (rx), or client to server and server to client. ...


1

(1,2) You could use: gpg2 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 --symmetric /*file path* According to The GNU Privacy Guard Manual, p. 71, we use --s2k-cipher-algo name when we want to apply symmetric encryption with a passphrase if --cipher-algo name or --personal-cipher-preferences string have not been set. ...


1

I) There is no minimum. Maximum in your case is $2^{64} * 16$ bytes with same key. II) No. No. GnuPG takes care of that. III) No. Compressing does not weaken encryption. IV) I don't think it matters because it is not authenticated encryption. V) Yes, passphrases must be different. VI) In your case you can get maximally 256-bits of security per cipher. ...


1

To my knowledge, there is no white-box cryptographic algorithm that is "secure" in cryptographic sense, that means its security depends on a random key from a space of certain size. In practice the "security" of white-box cryptography is achieved by hiding implementation and by employing automated updates to quickly replace the key with new implementation ...


Only top voted, non community-wiki answers of a minimum length are eligible