Skip to main content
34 votes

What is the maximum size of the plaintext message for RSA OAEP?

Important note: usually OAEP is only used to encrypt a random symmetric key, which is then used to encrypt a plaintext message; this is called a hybrid cryptosystem. Repeated use of OAEP would require ...
Maarten Bodewes's user avatar
  • 93.3k
13 votes
Accepted

What are the risks of using CTR mode with 64 bit blocks?

I believe that he was referring to the misconception that the birthday problem that arises in encryption is only when you use the same counter twice. If a random IV is used, then such a counter ...
Yehuda Lindell's user avatar
11 votes
Accepted

How does using a really small block size reduce the key space?

How does a small block size reduce the key space? Let $b$ be the block bit size of a block cipher. There are $2^b$ possible block values, for a plaintext, and for a ciphertext. For a fixed key, there ...
fgrieu's user avatar
  • 142k
10 votes
Accepted

SHA-3 block sizes / bitrate calculation?

First of all, in the case of SHA-3 we don't call it block size but bitrate. SHA-3 has been formally defined in FIPS 202 and in its reference manual. We define the sponge function denoted by $\...
Biv's user avatar
  • 10k
8 votes

What are the risks of using CTR mode with 64 bit blocks?

This answer summarizes what's achieved against CTR mode in the paper pointed by Yehuda Lindell's answer: Gaëtan Leurent and Ferdinand Sibleyras's The Missing Difference Problem, and its Applications ...
fgrieu's user avatar
  • 142k
8 votes
Accepted

What is a wide block cipher and why does it avoid birthday bound problems?

I don't think the term "wide block cipher" has a hard definition beyond has a larger block size than the current standard algorithm(s) which right now in most cases would equal to has a block ...
SEJPM's user avatar
  • 46.2k
7 votes
Accepted

How does blocksize affect security?

Block ciphers are usually used in modes of operation. The security of a mode of operation depends on two things: the security of the underlying block cipher, and the security of the mode itself when ...
pxdnr's user avatar
  • 421
7 votes
Accepted

Why are block ciphers mostly used as stream ciphers?

Why are block ciphers mostly used as stream ciphers? CTR mode doesn't need padding like the CBC mode that caused many attacks over the years knowns as the padding oracle attack [1] [2]. Finally, CBC ...
kelalaka's user avatar
  • 49k
7 votes
Accepted

What would be the maximum acceptable block size for disk enryption?

AES-XTS is a mode of operation of AES that encrypts blocks, but is not a blockcipher. It has the security drawback that when information in a large block changes locally (e.g. a single byte), it's ...
fgrieu's user avatar
  • 142k
6 votes

What is the typical block size in RSA?

It is seldom a good idea to encipher more than one block with RSA alone, thus the question is moot. One should use hybrid encryption, where the bulk of the data is symmetrically enciphered with a ...
fgrieu's user avatar
  • 142k
6 votes
Accepted

What's the proper choice for the block size of a sponge-based hash?

The "block size" matters for Merkle-Damgård functions because the HMAC security proof relies on that block size. For other functions, and in particular sponge functions, the block size for HMAC is ...
Thomas Pornin's user avatar
6 votes

Does the block size of a symmetric cipher impact the security of the cipher itself?

Does the block size of a symmetric cipher impact the security of the cipher itself? Yes, absolutely. A small block size limits the amount of data that can be encrypted with a given key, and some ...
forest's user avatar
  • 15.3k
6 votes
Accepted

How many required known plaintexts for an attack are considered insecure?

Firstly, is this a correct threshold for considering a cipher secure? Not exactly. Security is a spectrum, so what is secure for some applications may not be secure for others. Is a $2^{-64}$ ...
forest's user avatar
  • 15.3k
6 votes
Accepted

How to securely encrypt/decrypt data with a maximum chunk size?

I have a solution that may satisfy you Splitting the file into parts (chunk) and chaining them is a solution for you. To prevent the truncation we will use the associated data, which is the same for ...
kelalaka's user avatar
  • 49k
5 votes

Can data over a very low bandwidth channel still be encrypted?

If the sender and recipient can agree on the nonce of every message from existing context, so that the nonce either doesn't need to be transmitted or can be derived from metadata that must be ...
Luis Casillas's user avatar
5 votes

what is the block in crypto

A "block" is the amount of bits your block cipher operates on (There are other kinds of ciphers, see below.) Think of a Caesar cipher, it replaces letters in words. For example with key 13 it ...
Elias's user avatar
  • 4,933
5 votes

How does blocksize affect security?

Block size does not directly affect the security of the cipher. However, if block size is too small, it can prevent you from using the cipher securely. The main effect of block size is due to the ...
otus's user avatar
  • 32.2k
5 votes
Accepted

Why blake2b is the fastest despite it being 512 bits hashing algorithm?

I am struggling to understand why blake2b is faster than blake2s, despite that blake2b is 512 bits hashing. Comparing is not easy. They designed BLAKE2b for 64-bit platforms including NEON enabled ...
kelalaka's user avatar
  • 49k
4 votes

What's the proper choice for the block size of a sponge-based hash?

Iterated hashes generally accumulate a fixed amount of data and then call a compression function (or a permutation in the case of sponges) on this data together with a chaining-value. The block size ...
CodesInChaos's user avatar
  • 24.9k
4 votes
Accepted

How does Feistel cipher create diffusion between blocks?

If a message is longer than the block length, how would changing one part of the message affect the encryption of other parts of the message? That really doesn't depend on the block cipher in use,...
SEJPM's user avatar
  • 46.2k
4 votes
Accepted

Can data over a very low bandwidth channel still be encrypted?

Yes, encryption can be without increase of the message size, even if the ciphertext is constrained to the same character set/semantic as the plaintext (e.g. to fit the semantics imposed in the body of ...
fgrieu's user avatar
  • 142k
3 votes
Accepted

what is the block in crypto

Lots of practical cryptographic algorithms operate on variable length inputs. E.g., if you're encrypting messages, you want your algorithm to be able to handle messages of any reasonable length. But ...
Luis Casillas's user avatar
3 votes
Accepted

Weird size of data transmitted in SSLv3

You won't find the answer in the RFC; instead, here's what your SSL implementation is doing: when you send a single byte of data, it actually generates two records. The first record is empty; so it ...
poncho's user avatar
  • 148k
3 votes
Accepted

BLOCK SIZE in CBC and GCM

No, GCM does not require padding, nor does it require plaintext to be a multiple of the block size. GCM is a mode that combines CTR, which is a stream cipher mode, with GMAC authentication, which ...
Richie Frame's user avatar
  • 13.1k
3 votes

Is the risk of a collision for OCB mode mitigated by upping the block size of the cipher?

Using a larger blocksize in a cipher will always aid in mitigating collisions. For a practical example, take what OWASP says about key management: If the amount of data encrypted grows beyond a ...
Tuxxy's user avatar
  • 45
3 votes

Is it possible to determine the symmetric encryption method used by output size?

You can try to determine the block size by modifying each byte of the input data, starting from the last one. A typical block cipher implementation will mix the change into all other bytes in the ...
jpa's user avatar
  • 358
3 votes

AES-128 CBC encryption : ciphertext size seems too large

ECB and CBC require padding or a scheme called ciphertext stealing if the size of the messages is not a multiple of the block size. Commonly a scheme such as PKCS#7 padding is applied, quite often by ...
Maarten Bodewes's user avatar
  • 93.3k
2 votes
Accepted

How is the block size of a block cipher related to how susceptible the block cipher is to a birthday attack?

If you encrypt (partially) random values then the likelyhood that you encrypt the same value is larger for block ciphers that operate of fewer bits. If you encrypt the same value with the block cipher ...
Maarten Bodewes's user avatar
  • 93.3k
2 votes

What is the typical block size in RSA?

It depends on the key size and the selected padding. The max block size is (in bytes): key_size_in_bytes - padding_margin The padding margin is as follows: RSA/...
Lancelot Chen's user avatar
2 votes

number of blocks, and size of padding at 64bit

As written, this exercise is ambiguous, since we don't know how many bits make one character, or even if this number is constant or not. (For e.g. Unicode text using the UTF-8 encoding, it's not &...
Ilmari Karonen's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible