49
votes
Accepted
7zip : Why does encrypting the same file with AES-256 not give the same output?
This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable.
It was using 64-bit IV but ...
- 46k
48
votes
Accepted
Why was AES CBC removed in TLS 1.3?
Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked.
AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
- 5,289
22
votes
Accepted
Why does "2xAES-256" provide "99.99%" security strength whereas "1xAES-128" provides "40%"?
It's meaningless nonsense. I would be inclined to avoid spending any money with these people. If you scroll down on this page, you'll find a table labelled key size vs. time to crack, according to ...
- 2,053
21
votes
Accepted
Bit Flipping Attack on CBC Mode
The Bit Flipping attack
Decryption process in CBC mode is performed as
\begin{align}
P_1 =& Dec_k(C_1) \oplus IV\\
P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb,
\end{align}
where $nb$...
- 46k
20
votes
7zip : Why does encrypting the same file with AES-256 not give the same output?
Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was ...
- 14.3k
19
votes
Accepted
Why is padding used in CBC mode?
So, I'll answer the theoretical part of your question, since we need a key to address the practical part.
Why is padding used in CBC?
Blockcipher such as AES are encrypting blocks of a fixed given ...
- 7,479
17
votes
Why not authenticate full-disk encryption?
Authentication and probabilistic encryption are two desirable features which each take up a small amount of extra space. And you are absolutely right that the percentage of space consumed is of no ...
- 1,377
17
votes
Why was AES CBC removed in TLS 1.3?
TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility.
Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
- 90.2k
14
votes
Why not authenticate full-disk encryption?
So, are there reasons for not using authentication that I'm missing?
I believe that the real reason is not actually space, but time.
As you said, storing the tags would not require that much space. ...
- 140k
13
votes
Accepted
Why not authenticate full-disk encryption?
With 4096-byte sectors, space is a complete non-issue, less than 1 %
Problem 1: 10GB per TB is not a "complete non-issue" for many people.
Problem 2:
If the checksums are inside of their data ...
- 1,187
13
votes
Accepted
Are there any benefits to using ECB over CBC?
ECB benefits:
It's a tiny bit easier to implement.
It allows for parallel encryption and decryption (CBC only decryption).
A single corrupted cipher block corrupts only one block of plain text(in ...
- 11.6k
13
votes
Is DES secure under CBC?
No, it will be insecure. There are two reasons;
Due to the smaller key size 56-bit; DES was tested for brute-force attack since published.
DES_CHALL, 96 days to find the CES challenge key in 1997.
...
- 46k
12
votes
Accepted
Why can't we use the first block of AES-CBC as MAC
The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
- 90.2k
12
votes
Predictable, but private IV in CBC
If a nonce $N_i$ is even, then the binary numeral for it its increment $N_{i+1} = N_i + 1$ differs from $N_i$ only in its least significant bit; and if $N_i$ is odd, its increment is even. This means ...
- 14.3k
12
votes
Accepted
CBC-Mode Infinite Garble Extension
The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
- 90.2k
12
votes
Accepted
What is the correct way to implement PBKDF2 + AES CBC + HMAC?
You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
- 3,905
12
votes
Random data CBC padding scheme?
Padding is dangerous. CBC mode with padding is secure against chosen-plaintext attacks, where the adversary can convince the legitimate party to encrypt messages and obtain the ciphertexts. But it is ...
12
votes
Accepted
Always set the IV to 0 randomized CBC
This will be dangerous if there is a high probability of repeated initial blocks across plaintext. Cryptographers like to make as few assumptions as possible about the structure of plaintext and so ...
- 20k
11
votes
Why is CBC with predictable IV considered insecure against chosen-plaintext attack?
The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
- 228
11
votes
Accepted
Why is Fernet only AES-128-CBC?
This seems to me to be less secure...
Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require $O(2^{...
- 140k
11
votes
Are there any benefits to using ECB over CBC?
From a theoretical point as a mode of operation ECB mode has only one advantage over all of the other modes: it doesn't require an IV. That means that the ciphertext doesn't expand if the message is a ...
- 90.2k
11
votes
What is DES-EDE3-CBC?
At least in the context of PKCS#5 (which is commonly seen through the encryption of PEM files), DES-EDE3-CBC is Triple DES with three keys, used in CBC mode, with unspecified padding.
Yes, “EDE” means ...
10
votes
AES key equal to IV (CBC mode)
In this answer I'm assuming that a key is used to encrypt more than one message.
The first weakness is that CBC with fixed IV leaks if messages share a common prefix.
The second weakness is that it ...
- 24.6k
10
votes
mode of operation in cryptography
I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
- 38.3k
10
votes
mode of operation in cryptography
You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
- 90.2k
10
votes
Why was AES CBC removed in TLS 1.3?
from what I know CBC is the most secure Mode of operation for the AES block cipher
I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
- 140k
10
votes
Accepted
Why does error propagation in CBC mode encryption affect two blocks?
Encryption process in CBC mode is performed as
\begin{align}
C_1 &= Enc_k(P_1 \oplus IV)\\
C_i &= Enc_k(P_i \oplus C_{i-1}),\;\; 1 < i \leq nb,
\end{align}
where $nb$ is the number of ...
- 46k
9
votes
Should I use ECB or CBC encryption mode for my block cipher?
Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations.
Although ECB and CBC are modes of operation of a block cipher, you could ...
- 90.2k
9
votes
Accepted
Precisely how does CBC mode use the initialization vector?
The schemas from the relevant Wikipedia page really explain it all:
As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
- 911
9
votes
Accepted
ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?
There is no good way to calculate a strength difference between ECB and CBC. ECB is broken as a generic cipher - it is not indistinguishable under chosen plaintext attack - as repeating blocks will ...
- 90.2k
Only top scored, non community-wiki answers of a minimum length are eligible