New answers tagged

0 votes

Delayed tag checks in AES-GCM for streaming data

At the risk of showing my lack of knowledge on the subject here, what is the point in using a stream block mode like gcm when you'd have to break it into discrete chunks in order to authenticate each ...
user avatar
  • 101
1 vote
Accepted

Encrypting two messages with the same content with different keys/IVs still secure if attacker knows they are the same?

Yes, that should be secure as long as each algorithm is CPA-secure (as AES, Chacha20 and Serpent should be), and the keys are chosen independently and uniformly at random (different keys is not enough)...
user avatar
  • 124k
1 vote

What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?

I have implemented CMAC from CBC-MAC and just AES in CBC mode. CBC-MAC - as the name implies - can certainly be implemented using CBC long as you have some space to temporarily stash the unneeded ...
user avatar
3 votes
Accepted

Key Committing AES-GCM

do I understand correctly that $\mathcal{A}$ needs to be able to 'modify' the ciphertext $C$ to be able to perform the outlined attacks? No, these attacks assume that the attacker generates $C$; he ...
user avatar
  • 132k
1 vote

Is it safe to "compress" an IV in AES256-CTR?

Brute force doesn't come into play; an IV is considered public knowledge. An attacker could try and let you encrypt additional messages to force an integer overflow within the encoded counter though. ...
user avatar
1 vote

What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?

TLDR -> Does the CMAC in SCP03 use AES in CBC mode? In not familiar with the SCP03 protocol, but the confusion stems from how AES is used in CMAC. Technically, we don't need to talk about "...
user avatar
  • 1,333
0 votes

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

The AEADs are internally computing a hash value over the encrypted data. That hash is sent together with the encrypted data. Adding a second hash as MAC together with a MAC key would not provide more ...
user avatar
  • 136
2 votes

Why does AES-GCM means No MAC key, instead of MAC key what they are going to use?

TLS records need to be protected both for confidentiality (defence against an attacker learning their content) and for authenticity (defence against an attacker modifying them in transit). So they are ...
user avatar
2 votes

Faster cipher than AES256-CBC to use for DRM purpose

If you are writing your own implementation of AES, and can use the AES-NI instruction set, then you will end up with a cipher that is mathematically secure and fast. Very fast... AES in hardware is ...
user avatar
  • 12.7k
1 vote

Benchmark for CSPRNG as stream ciphers?

The ChaCha20 cipher works at > 80 MiB/s on a single CPU core, so a modern GPU with hundreds or thousands of execution units would achieve the required performance of 100 Gbps. This is theoretically ...
user avatar
  • 111
6 votes

I didn't understand why both an implicit and an explicit nonce is used in AES-GCM in TLS 1.2

Question: I am not understanding that, what is main purpose of using these implicit nonce and explicit nonce and why it is only sending explicit part only? With the nonce, one important goal we need ...
user avatar
  • 132k
0 votes

Faster cipher than AES256-CBC to use for DRM purpose

Try OpenSSL. It has assembly language routines which take advantage of CPU specific instructions that are intended to speed up AES. The assembly routines do have to be enabled when building OpenSSL. ...
user avatar
  • 1,900
1 vote

What's the best way to recover an AES-256 key from partial key, ciphertext, plaintext and IV?

Knowing some bytes of AES's uniform random key doesn't help you recover faster on brute force. Otherwise, we would hear that years ago. So you have $7+19= 26$ bytes for AES-256 which needs 32 bytes ...
user avatar
  • 43.4k
1 vote

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

This will allow recovering the key stream but not the key. There are no known practical known plaintext key recovery attacks on AES. The keystream will not be usefull unless you reuse the nonce(IV). ...
user avatar
  • 10.5k
3 votes
Accepted

For AES-GCM, does knowing plaintext and ciphertext allow attacker to learn the key?

AES is not vulnerable to known-plaintext attacks, and AES-GCM is no different. GCM mode is extremely similar to CTR, or counter, mode. It functions by passing an incrementing counter through AES. The ...
user avatar
  • 13.3k

Top 50 recent answers are included