New answers tagged

3

Currently, the quantum attacks work on the block cipher itself. The Grover's search algorithm reduces the complexity of 256-bit key into 128-bit since it has complexity $\mathcal{O}(\sqrt{n})$ and in the case of 256-bit $\mathcal{O}(\sqrt{2^{256}}) = \mathcal{O}(2^{128})$ Since you have started with 128-bit entropy, theoretically, the quantum attacker to ...


6

As already mentioned in the comments to your question, implementations of AES are aplenty on Github, depending on the language you want to use and on the type of requirements you have, including the original ANSI C reference implementation. However, if you are interested in timing analysis of AES implementations, you might as well want to take a look at the ...


6

The number of rounds does not directly influence security; it depends at least as much on the complexity of those rounds. That said, it is possible to use the percentage of rounds for which there are attacks as an indication on how much crypt-analysis has advanced (disregarding those attacks that are worse than brute force, of course). One tricky thing with ...


3

How the counter and nonce are related is specified in e.g. NIST SP 800-38A: Recommendation for Block Cipher Modes of Operation Methods and Techniques, Appendix B: Generation of Counter Blocks. I'll list the second approach, as the first approach - just concatenating all the messages - is stupid and really never used: A second approach to satisfying the ...


1

There is only one way I see how to avoid having this block of garbage in you plaintext after CBC bit flipping attack, but it requires to be able to see the result of the decryption and to know the whole plaintext you are attacking, which may not be the case in most practical scenarios. Say you want to alter the third block of plaintext, P3: Do your CBC bit ...


0

In the end, it was easiest to just code this in Python. For those interested, here's the bare basics code. DO NOT USE THIS CODE IN PRODUCTION There's no real file handling, no handling of decryption errors, IV and key are in code and not randomly determined. Importing relevant libraries: import os from cryptography.hazmat.primitives.ciphers.aead import ...


0

According to this survey of block cipher modes (pp. 30-37), OFB mode is not SemCPA secure if the IV is a nonce, but "secure with a fixed sequence of IVs, like a counter." This responds to a subtle nuance in this paper: the security model that Rogaway uses allows nonces to be selected by the adversary, so the attacks shown against nonce-based OFB rely on such ...


0

You could see each iteration as a try to verify passphrase. In that case you can simply take the 2-log of the number of iterations to see how many bits of security are added. So $\log_2(50000) = 15.6$ bits of security, which can more or less be added to the strength. A million repetition ads about $19.9$ bits of security. Now a good password phrase with 4 ...


9

Disclaimer: The original question was more general than "is AES circular secure", since AES was cited as an example only. You are asking for a circular secure scheme. This is not as simple as it seems, because the security games that we use to prove security generally go (roughly) like this : An oracle generate the keys; The adversary chooses two ...


6

I'd assume not; after all, how does having the key for a safe inside the safe make it easier to pick the lock? Physical analogies like these are dangerous; cryptography is not locksmithing. Rather, we should appeal to security notions that come from cryptography itself. For example, a block cipher is a practical attempt at implementing a pseudo-random ...


0

You could also check if you're version of OpenSSL supports CCM mode. That's an authenticated mode just like GCM. I tried a version of OpenSSL I happened to have on my machine and it supports CCM, but not GCM.


3

LibreSSL supports AEAD ciphers, including aes-256-gcm: $ openssl enc -aes-256-gcm -nosalt -p -in file.in -out file.out enter aes-256-gcm encryption password: Verifying - enter aes-256-gcm encryption password: key=A744E1091C25BABD36B50E40FB8D311A672722729CEA6E217AD9FA8AF23CAF57 iv =BDEEA37B93BB989C6C40665B If you don't mind writing your own software, there ...


3

Is it secure to encrypt with AES CFB mode a plaintext for which the first bytes are known (e.g. %PDF-1.5 for a PDF document) Yes. Known (and even chosen) plaintext is a standard assumption in any moder cipher, including AES-CFB (and CTR, CBC, OFB...). It does not "give too much information to an attacker", and it is not "bad to encrypt documents with known ...


1

As secure as any. Known headers aren't going to decrease security, but using SHA256 as a KDF will. Use Scrypt; it's many times more secure. And iv = Crypto.Random.new().read(Crypto.Cipher.AES.block_size) is better as iv = os.urandom(128). It's the same underlying function, and AES' block size doesn't change.


0

You may notice that the length of the output of the encryption function is the same as the length of the plaintext. That suggests an inherent problem. In order to verify something, we need something else to compare it to. But that something else hasn’t been attached to the ciphertext (or else the length would be different) and wasn’t returned separately ...


2

If you will look at Probabilistic encryption in Wikipedia, that will explain shortly. GCM mode internally uses CTR mode and therefore let's concentrate on CTR mode. CTR mode converts a block cipher into a stream cipher. In CTR mode, one encrypts the $(nonce\mathbin|counter)$ then x-or the plaintext then increments the counter like $$C_i = P_i \oplus E(k, ...


2

The difference of one byte before MixColumn will propagate to the whole column. The goal of this step is to mix the four bytes together to get another four bytes. Look at the definition and try it yourself. Also, there is some nice property here. There are $256$ possible values for the XOR difference of the two bytes and since MixColumn is linear, the XOR ...


2

The paper's tables in Appendix A are wrong. For the entries in the first line of Table A1(a) I independently get: 0A 15 3F 2C 90 3B 19 51 FD EF 28 8C 83 A0 A7 36 and the fourth value (for input 03h) matches the OP's computation. Note: there are fixed points (including 23h), invalidating the list of the valid additive constants, which is about the only ...


2

"Normal" AES implementations and tiny-AES perform the same task. As stated in the README: This is a small and portable implementation of the AES ECB, CTR and CBC encryption algorithms written in C. It's simply an implementation with low memory usage. The reason for the existance of tiny-aes can be traced back to the initial search for a replacement for ...


1

Generally we first encode the text to binary and then do the encryption. Then we can decrypt and decode to text again. If that suits your need then you can use any secure cipher. The conversion of a textual message to binary is called character encoding. UTF-8 is probably the most used encoding as it supports all Unicode characters & code points, keeps ...


3

In most cases, you should probably use AES, especially if there is hardware support. In some cases, it might make sense to use one of the others. For example, the simplicity of Threefish would make sense for an embedded controller using a micro lacking hardware support for AES. Its lack of S-Boxes reduces the amount of ROM needed. If you don't need the ...


2

Yes. HOWEVER.... An implementation may put the content of the encrypted message wherever it wants, and format the encrypted message any way it wants, including different text encodings such as Base64 You will need to take that into account, when decrypting the message, the input must be formatted in the way that an implementation is expecting, and that ...


1

The security bound for this construction is (PDF, section 4.7.3 in v4) $$\mathbf{Adv}^{\text{sPRP}}_{\text{AESX-192}}(\mathcal A)\leq \frac{2Q_sQ_{AES}}{2^{192}\cdot 2^{128}}$$ to be a strong PRP assuming AES can be modeled as an ideal cipher (not perfectly accurate but probably "close enough" here), where $Q_s$ is the number of "online" queries against a ...


Top 50 recent answers are included