# Tag Info

4

The AES block cipher supports various key sizes of 128, 192, and 256 bits, and a single block size of 128 bits. The degree-8 polynomial $x^8+x^4+x^3+x+1$ is the one used in AES-{128,192,256} for MixColumn and SubBytes. There is no $\operatorname{GF}(2^{256})$ in GCM because GCM only supports block size of 128 bits. The degree-128 polynomial $x^{128}+x^7+x^2+... -1 If, by H, you are referring to the hash key (used to create the tag), it is generated by encrypting an all-zeros block with the encryption key. So it is no trouble to regenerate that. But to recover the nonce (or often called the IV (Initial Vector)), I think only Maarten's answer will work. I believe the IV is sent in-the-clear during a key exchange, so ... 4 You'll have to guess the plaintext of at least one block (128 bits) that is on a 128 bit boundary from the start of the GCM ciphertext. Then you can XOR it to retrieve 128 bits of the key stream. Now the key stream you can decrypt since you have the key. This will get you a counter value. The counter in GCM mode starts with a 12 byte nonce and the counter ... 3 Is it secure if I remove the top-bit of the one block to make it 127-bit? Yes truncating the output of a PRF produces a new PRF, which can be easily seen by a simple reduction. Assume you had an adversary that could break the truncated PRF, then you would forward all queries to the untruncated PRF and truncate the result (which is a perfect simulation) and ... 1 NIST SP 800-38A ("Recommendation for Block Cipher Modes of Operation Methods and Techniques "), Appendix B states that "The standard incrementing function takes [x]m and returns [x+1 mod 2^m]" (my formatting, they used typesetting to show exponents). Section B.1 goes into more detail about recommendations for the CTR mode incrementing function. Regarding ... 1 With regard to the structure of RSA key files, and how the public key is related to the private key - you can see that the modulus in the public key file is the product of the two large primes contained in the private key file by doing the following: Generate a private key: openssl genrsa -out private.key 2048 Extract the public key from the private key ... 1 elements of$GF(p)$are integers, while elements of$GF(p^n)$are polynomials.Why the difference? TL;DR: because integers modulo$p^n$do not form a field. Here's a pragmatic construction of$GF(p^n)$useful for applied cryptography, including AES which uses the field$GF(2^8)$extensively.$GF(p)$for prime$p$is the field of arithmetic modulo$m$for ... 4 The question's code works for AES-128 and AES-256, but indeed does not for AES-192, for the reason pointed in the question. Yes changing if ( !( i % 36 ) ) into if((!(i%36)) && (key_words == 4)) as suggested in comment by the OP is enough to make it (and the rest of the code) pass the example of appendix A.2 and C.2 of FIPS 197 (as well as A.1, ... 4 Is it safe to store all of that information at the same place? All the information (salt, pbkdf2, iterations, iv, GCM tag, encrypted payload) is listed can be considered as public information. We already consider that an attacker has the knowledge of all of these but the encryption key by the Kerckhoffs's principle. A log file will typically ... 2 Are there any implications on security if the AES-CMAC algorithm is modified in this way? There is no security implications by modifying$\text{AES-CMAC}$by replacing the$\text{AES}$block cipher component with$\text{AES}^{-1}$. Both are equally strong block ciphers; if$\text{AES}^{-1}\text{-CMAC}$were found to have a weakness, that would imply that$\...

2

Why is the clear communication of the UID such a problem? Problem is that most RFID tags can be read at a distance, without the holder knowing. Since the UID is readable, and if it is fixed, that can help track the holder. That's why there is a trend¹ in modern RFID tags towards random UIDs (RID), and making it necessary for the tag reader to hold a key in ...

2

This would be possible by using textbook RSA, where the ciphertext is deterministic You have the right idea there, that a deterministic scheme is the way to go. However note that every scheme is deterministic if you explicitly fix the randomness used. So suppose you encrypt $k$ for $C$ as $c=\operatorname{Enc}_{\text{pk}_C}(k;r)$ using $C$'s public key and ...

1

As David Wong commented, NIST has proposed CTR-DRBG as the secure way to do it. Here is a link to an implementation in Python using CTR-AES-128. However, it should be noted that quite recently (2019-11) a side-channel attack was published (by Lauren De Meyer, COSICS) to recover the key and a nonce using only 256 power traces of CTR-AES. Thus, one should be ...

2

kelalaka answered your questions, however I do believe there are things that could use some clarification: RFC 4106 specifies about nonce. It contains a salt of size 4 octets and an iv of size 8 octets. Further, RFC specifies that salt is assigned at the beginning of the security associations which is established through Internet Key Exchange (IKE) and ...

1

1. I know that AES-GCM can be used for authentication of data by Can we use AES-GCM mode only for encryption by ignoring authentication? Let's remember that AES-GCM uses AES in CTR mode for confidentiality and GMAC for integrity and authentication. Of course one can use AES-GCM without authentication by discarding the authentication tag. One will have some ...

2

I thought I'd update this with what I learned designing my ASIC. I found the literature and terminology very ambiguous, even McGrew & Viega's paper on GCM. Thanks to Poncho and others for their answers. Here are some notes from my code: ************************* Nonce Format ***************************** |<-- Counter Block (CB) (128 ...

1

We assume that Bob knows B and Enc(K1, ABC) but doesn't know K1, A or C. Then the only information Bob can learn about ABC is the length of AC (not even the length of A and C individually). If Bob knows Enc(K1, M), Bob can't even tell whether B is a substring of M. This is assuming that Enc is any sensible symmetric cipher, including AES-CBC (with a random ...

6

I saw some SWIFT code that generates IV for AES 256 from selecting 16 characters from a-zA-Z0-9 space. Is this secure? Sufficiently secure? Almost always, when you see that modern ciphers are initialized by strings then the developer doesn't really understand that ciphers operate on binary data. This is a development practice that has got a special ...

0

Is your "-K" in the code in uppercase or lowercase? If it is in lowercase, the encryption will automatically add a salt value into your cipher text, causing it to have more than 32 bytes. CBC will pad it until it reaches 48 bytes later(the multiplication of 16).

Top 50 recent answers are included