7

Why are block ciphers mostly used as stream ciphers? CTR mode doesn't need padding like the CBC mode that caused many attacks over the years knowns as the padding oracle attack [1] [2]. Finally, CBC is removed from the TLS, TLS 1.3 has only CTR mode ciphers (rfc 8446). +------------------------------+-------------+ | Description ...


4

The problem is that you are trying to put a generic security comparison on AES-128 and AES-256. I would argue that if you're going to dig deeper - as you currently do - then this idea that there is a "generic security level" as I would coin it, is flawed. As you said, there is a related key attack that is only valid for AES-256, mainly related to ...


3

For example, if $F$ is the round function for AES-128 or DES, then does $\{f_k | k \in K \}$ generate the alternating group $A_X$? In the case of DES, then, yes it is known that the round function does generate the alternating group, as shown in this paper ("The One-Round Functions of the DES Generate the Alternating Group" by Ralph Wernsdorf). I ...


2

In short, AES-256 beats AES-128. Use AES-256 which is the golden standard; Cryptanalysis The attacks on AES-256 doesn't make it insecure practically, even after 20 years the best attack has the complexity of $2^{254.3}$ for AES-256 and $2^{126.0}$ for AES-128 2015 Improving the Biclique Cryptanalysis of AES, Biaoshuai Tao and Hongjun Wu. The related key ...


1

Well, you said that this was a "practice problem"; hence you're supposed to learn from it, so I won't give you the answer. I will give you a hint: you have $E_k(M) = \Pi(M \oplus K) \oplus K$; suppose you defined $F_k(M) = E_k(M) \oplus E_k(M \oplus 1)$, and further defined $G$ such that $F_k(M) = G( M \oplus K )$ (and yes, such a $G$ exists ...


1

This is, I think, your most important point (from the comments): I am aware that replay attacks can be avoided by adding timestamps or counters. However the device A preserves no state between reboots (it's an embedded device) and has no internal clock (I don't want to rely on synchronizing the time over the internet as this would rely on having a working ...


Only top voted, non community-wiki answers of a minimum length are eligible